Talos Rules 2016-09-13
This release adds and modifies rules in several categories.

Talos has added and modified multiple rules in the and file-office rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

2016-09-14 00:12:00 UTC

Snort Subscriber Rules Update

Date: 2016-09-13

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2976.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:40175 <-> DISABLED <-> FILE-FLASH Adobe Flash Player out of bounds memory access attempt (file-flash.rules)
 * 1:40153 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed VideoFrame memory corruption attempt (file-flash.rules)
 * 1:40179 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40180 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40151 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DRMManager memory corruption attempt (file-flash.rules)
 * 1:40181 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40152 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DRMManager memory corruption attempt (file-flash.rules)
 * 1:40154 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed VideoFrame memory corruption attempt (file-flash.rules)
 * 1:40155 <-> DISABLED <-> FILE-FLASH Adobe Flash AVC Decoder Memory Corruption attempt (file-flash.rules)
 * 1:40156 <-> DISABLED <-> FILE-FLASH Adobe Flash AVC Decoder Memory Corruption attempt (file-flash.rules)
 * 1:40157 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed placeObject2 memory corruption attempt (file-flash.rules)
 * 1:40158 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed placeObject2 memory corruption attempt (file-flash.rules)
 * 1:40159 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetStream type confusion attempt (file-flash.rules)
 * 1:40160 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetStream type confusion attempt (file-flash.rules)
 * 1:40161 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40162 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40163 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40164 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40165 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40166 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:40167 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:40168 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DisplacementMapFilter use-after-free attempt (file-flash.rules)
 * 1:40169 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DisplacementMapFilter use-after-free attempt (file-flash.rules)
 * 1:40170 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player use after free attempt (file-flash.rules)
 * 1:40171 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player use after free attempt (file-flash.rules)
 * 1:40172 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player out of bounds memory access attempt (file-flash.rules)
 * 1:40173 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player out of bounds memory access attempt (file-flash.rules)
 * 1:40174 <-> DISABLED <-> FILE-FLASH Adobe Flash Player out of bounds memory access attempt (file-flash.rules)
 * 1:40176 <-> DISABLED <-> FILE-FLASH Adobe Flash ContextMenu Clone memory corruption vulnerability attempt (file-flash.rules)
 * 1:40178 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40177 <-> DISABLED <-> FILE-FLASH Adobe Flash ContextMenu Clone memory corruption vulnerability attempt (file-flash.rules)

Modified Rules:


 * 1:40148 <-> ENABLED <-> FILE-OFFICE Microsoft Office PowerPoint ppcore invalid pointer reference attempt (file-office.rules)
 * 1:40147 <-> ENABLED <-> FILE-OFFICE Microsoft Office PowerPoint ppcore invalid pointer reference attempt (file-office.rules)

2016-09-14 00:12:00 UTC

Snort Subscriber Rules Update

Date: 2016-09-13

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2982.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:40174 <-> DISABLED <-> FILE-FLASH Adobe Flash Player out of bounds memory access attempt (file-flash.rules)
 * 1:40151 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DRMManager memory corruption attempt (file-flash.rules)
 * 1:40152 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DRMManager memory corruption attempt (file-flash.rules)
 * 1:40153 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed VideoFrame memory corruption attempt (file-flash.rules)
 * 1:40154 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed VideoFrame memory corruption attempt (file-flash.rules)
 * 1:40155 <-> DISABLED <-> FILE-FLASH Adobe Flash AVC Decoder Memory Corruption attempt (file-flash.rules)
 * 1:40156 <-> DISABLED <-> FILE-FLASH Adobe Flash AVC Decoder Memory Corruption attempt (file-flash.rules)
 * 1:40157 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed placeObject2 memory corruption attempt (file-flash.rules)
 * 1:40158 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed placeObject2 memory corruption attempt (file-flash.rules)
 * 1:40159 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetStream type confusion attempt (file-flash.rules)
 * 1:40160 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetStream type confusion attempt (file-flash.rules)
 * 1:40161 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40162 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40163 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40164 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40165 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40166 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:40167 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:40168 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DisplacementMapFilter use-after-free attempt (file-flash.rules)
 * 1:40169 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DisplacementMapFilter use-after-free attempt (file-flash.rules)
 * 1:40170 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player use after free attempt (file-flash.rules)
 * 1:40171 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player use after free attempt (file-flash.rules)
 * 1:40172 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player out of bounds memory access attempt (file-flash.rules)
 * 1:40173 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player out of bounds memory access attempt (file-flash.rules)
 * 1:40181 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40180 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40179 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40177 <-> DISABLED <-> FILE-FLASH Adobe Flash ContextMenu Clone memory corruption vulnerability attempt (file-flash.rules)
 * 1:40178 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40176 <-> DISABLED <-> FILE-FLASH Adobe Flash ContextMenu Clone memory corruption vulnerability attempt (file-flash.rules)
 * 1:40175 <-> DISABLED <-> FILE-FLASH Adobe Flash Player out of bounds memory access attempt (file-flash.rules)

Modified Rules:


 * 1:40148 <-> ENABLED <-> FILE-OFFICE Microsoft Office PowerPoint ppcore invalid pointer reference attempt (file-office.rules)
 * 1:40147 <-> ENABLED <-> FILE-OFFICE Microsoft Office PowerPoint ppcore invalid pointer reference attempt (file-office.rules)

2016-09-14 00:12:00 UTC

Snort Subscriber Rules Update

Date: 2016-09-13

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:40181 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40180 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40179 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40178 <-> ENABLED <-> FILE-FLASH Adobe Flash Player local-with-filesystem sandbox escape attempt (file-flash.rules)
 * 1:40177 <-> DISABLED <-> FILE-FLASH Adobe Flash ContextMenu Clone memory corruption vulnerability attempt (file-flash.rules)
 * 1:40176 <-> DISABLED <-> FILE-FLASH Adobe Flash ContextMenu Clone memory corruption vulnerability attempt (file-flash.rules)
 * 1:40175 <-> DISABLED <-> FILE-FLASH Adobe Flash Player out of bounds memory access attempt (file-flash.rules)
 * 1:40174 <-> DISABLED <-> FILE-FLASH Adobe Flash Player out of bounds memory access attempt (file-flash.rules)
 * 1:40173 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player out of bounds memory access attempt (file-flash.rules)
 * 1:40172 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player out of bounds memory access attempt (file-flash.rules)
 * 1:40171 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player use after free attempt (file-flash.rules)
 * 1:40170 <-> DISABLED <-> FILE-FLASH Adobe Standalone Flash Player use after free attempt (file-flash.rules)
 * 1:40169 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DisplacementMapFilter use-after-free attempt (file-flash.rules)
 * 1:40168 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DisplacementMapFilter use-after-free attempt (file-flash.rules)
 * 1:40167 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:40166 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShimContentResolver out of bounds memory access attempt (file-flash.rules)
 * 1:40165 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40164 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40163 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40162 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40161 <-> DISABLED <-> FILE-FLASH Adobe Flash Player navigatetoURL sandbox escape attempt (file-flash.rules)
 * 1:40160 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetStream type confusion attempt (file-flash.rules)
 * 1:40159 <-> ENABLED <-> FILE-FLASH Adobe Flash Player NetStream type confusion attempt (file-flash.rules)
 * 1:40158 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed placeObject2 memory corruption attempt (file-flash.rules)
 * 1:40157 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed placeObject2 memory corruption attempt (file-flash.rules)
 * 1:40156 <-> DISABLED <-> FILE-FLASH Adobe Flash AVC Decoder Memory Corruption attempt (file-flash.rules)
 * 1:40155 <-> DISABLED <-> FILE-FLASH Adobe Flash AVC Decoder Memory Corruption attempt (file-flash.rules)
 * 1:40154 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed VideoFrame memory corruption attempt (file-flash.rules)
 * 1:40153 <-> ENABLED <-> FILE-FLASH Adobe Flash Player malformed VideoFrame memory corruption attempt (file-flash.rules)
 * 1:40152 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DRMManager memory corruption attempt (file-flash.rules)
 * 1:40151 <-> ENABLED <-> FILE-FLASH Adobe Flash Player DRMManager memory corruption attempt (file-flash.rules)

Modified Rules:


 * 1:40147 <-> ENABLED <-> FILE-OFFICE Microsoft Office PowerPoint ppcore invalid pointer reference attempt (file-office.rules)
 * 1:40148 <-> ENABLED <-> FILE-OFFICE Microsoft Office PowerPoint ppcore invalid pointer reference attempt (file-office.rules)