Matt's Guide to Vendor Response
Well...it's that weird period between Christmas and New Years, and I've realized that I hadn't gotten anything for those wonderful people that keep the VRT employed.So as a gift to you, software vendor, I present Matt's Guide to Vendor Response.Now...this is a com
DEP and Heap Sprays
Usually when you need to use a heap spray, you're SOL when it comes to DEP. The reason for this has to do with why you used the heap spray in the first place. In the case of a vtable overwrite you need a chain of pointers to get the job done. A neat way to deal with this is t
Sourcefire VRT Labs
We are opening the Sourcefire VRT Labs for business. We've had a few useful things floating around in the jungle for a while now and we decided to make everything available, in one place, for everyone to use. Right now, Labs has a few resources on it we thought folks might fi
Adobe Reader media.newPlayer() Analysis (CVE-2009-4324)
First off its not Friday, and hopefully you'll have a better weekend. The reason for that is you are set with rules and clam sigs. Now what the heck am I talking about…. Last night Adobe released an advisory detailing an in the wild exploit for Adobe Acrobat that is current
Rule release for today - December 15th, 2009
More problems with Adobe Acrobat and Acrobat Reader via the media.newPlayer function. Couple of rules to cover it, check here: http://www.snort.org/vrt/advisories/2009/12/15/vrt-rules-2009-12-15.html for more details and changelog.
Operation: Don't Tell Lurene We're Working On This
If you've been following this blog for a while, you might have noticed that Lurene only shows up when there is evil to be done. This is why she is here; she's really, really good at it. She is also the analyst team lead and makes sure we are all keeping the fuzzers runnin
I hope you're happy Bejtlich...you cost me a ton of sleep
So after two days of getting up at the crack of dawn, having to deal with other VRT folks before they've had their coffee and then driving through commuter traffic and getting on the Metro, I came home from the SANS Incident Detection Summit completely exhausted. But as my he
December 2009 Vulnerability Report
Sourcefire VRT Vulnerability Report December 2009 from Sourcefire VRT on Vimeo. December Vulnerability Report. This month, Alain Zidouemba talks about Microsoft Patch Tuesday, Adobe patches and Google's DNS offering.
Microsoft Tuesday Coverage for December 2009
Six more advisories from Microsoft this month. Coverage is applicable for MS09-070, MS09-071, MS09-072, MS09-073 and MS09-074. There's also a patch or two from Adobe this month. By our count, that's the third "quarterly" patch this quarter. We think we've s