vrt rules
We are the Sourcefire Vulnerability Research Team. We are legion. Resistance is futile.
Updated: 30 min 23 sec ago
APT: Should your panties be in a bunch, and how do you un-bunch them?
There is no more predictable group of people than marketers. Once a term reaches a certain tipping point, they grab onto it for dear life and choke it until it means nothing. Apparently, the Advanced Persistent Threat (APT) hit that point somewhere around December. Despite the term being used by the defense industrial base for years, it wasn’t until this year that firms really started pounding
Rule release for today - March 10th, 2010
Microsoft Internet Explorer (2010-0806):
Microsoft Internet Explorer contains a programming error that may allow a remote attacker to execute code on an affected system.
Check it here
Oh, and the rule is a shared object rule, so the changelog won't actually show it. If you use PulledPork for your rule updates though, you should see it in the changes when you update.
Rule release for today - March 9th, 2010
Microsoft Security Advisory (MS10-016):
Microsoft Windows Movie Maker contains a programming error that may allow a remote attacker to execute code on an affected system.
Microsoft Security Advisory (MS10-017):
Microsoft Excel contains several programming errors that may allow a remote attacker to execute code on an affected system.
Apache HTTPD mod_isapi RCE (2010-0425):
The mod_isapi module
The Sudden Reappearance of MS03-039
Last Friday, I got into the office and pulled up my email. Among other things, there was an escalation from Sourcefire's support group, where the customer had alerts on SIDs 15512 and 3397, and they wanted an official opinion from Sourcefire as to whether the alerts they were seeing constituted false positives. Opening up the supplied packet captures, the DCERPC payload in question looked odd at
Rule release for today - February 26th 2010
Microsoft Internet Explorer contains a programming error that may allow a remote attacker to execute commands on a vulnerable system. The attacker needs to supply VBScript to invoke winhlp32.exe, which can then be used to execute commands via a specially crafted .HLP file.
http://www.snort.org/vrt/docs/ruleset_changelogs/changes-2010-02-26.html
CyberShockWave
There has been a lot of talk about CNN’s special presentation called “Cyber Shockwave” in the past couple of days. The program was an edited presentation of the 4-hour war games exercise that took place at the Mandarin Oriental Hotel in Washington D.C. Designed by Michael Hayden, a former CIA director, sponsored by the Bipartisan Policy Center and billed as a “simulated cyber attack on our nation
Microsoft Tuesday Coverage for February 2010
Well, Microsoft really made up for a light patch in January with a hefty dose of vulnerabilities this month. We had our hands full dealing with this avalanche, we have coverage for the non-local vulnerabilities, only a couple of issues were covered in previously released rules, the rest are all new.
Check out the rule release details here: http://www.snort.org/vrt/advisories/2010/02/09/vrt-rules
Introduction to the Shared Object Rules Generator
This is the first of a series of blog posts about writing Shared Object (SO) rules for snort. Not a lot of documentation exists as yet about how SO rules work or how to write them, and honestly this particular post isn't going to cover a lot of that information directly. Instead, we're going to go with an approach more akin to throwing everyone into the deep end of the pool but with a nice, big
Coming Soon To A Snort User's Group Near You
I was in Chicago last Friday for a meeting of the local Snort Users' Group (Powerpoint presentation available here). While the weather was as crummy as you'd expect out of Chicago in January, overall it was an excellent visit, thanks to the group of people who turned out for the meeting. The ChiSUG people are friendly, know their stuff, and had plenty of intelligent questions after my
Using byte_jump as a Detection Mechanism
This is just a quick tidbit about writing effective snort rules that I thought I would share. I was writing a Snort shared object (SO) rule for demonstration purposes. I was going to use a "vulnerability" where the DATA section, which is the last part of the packet, specifies a size that is smaller than the actual amount of data left in the payload.
The idea is based on a fairly standard
The Acrobat JavaScript Blacklist Framework
Adobe recently announced and released the Adobe Reader and Acrobat JavaScript Blacklist Framework. I've had a little bit of time to play with it and would just like to share my thoughts.
First of all, I am very pleased with this new blacklisting feature. Until now, when we knew about 0-day being actively exploited in the wild using JavaScript in some manner, we would just turn off JavaScript in
January 2010 Vulnerability Report
Sourcefire VRT Vulnerability Report January 2010 from Sourcefire VRT on Vimeo.January 2010 Vulnerability ReportThis month Alain Zidouemba talks about Microsoft Tuesday, Adobe patches, Snort and ClamAV releases. From the beach. Where it's warm. While the rest of us freeze. Just saying. Putting it out there.