of Pigs and Rockets
It was a quiet day at Sourcefire World Domination Headquarters and somebody wasn't keeping a close eye on the stock of squishy pigs that we give out at trade shows. The VRT had just finished some intensive work and it was a fine Friday afternoon in September. We had some mode
Bamboo -> angel tongue
#include <stdio.h> struct newClass { char type; int size; char *data; void (*printer)(char*); }; void painter(char *input) { char buf[4096]; memcpy(buf, input, sizeof(buf)<strlen(input)?sizeof(buf):strlen(input)); r
Rule release for today - September 17, 2009
Maintenance release that adds support for shared object rules for the Snort 2.8.5 release. Also, additions to the web-client, specific-threats, web-misc, misc, oracle and exploit rule sets. More information and changelogs here
Snort 2.8.5 Release
We warned you in the August Vulnerability Report that Snort 2.8.5 was almost ready to be released. Well, today is the day. Snort 2.8.5 is now available for download. All VRT Certified rule releases will now be 2.8.5 compliant and we will cease to support 2.8.4 (in 90 days) in fa
Rule release for today - September 15, 2009
Mostly a maintenance release, we added multiple rules in the specific-threats, dns, web-client, dos, ftp and misc categories. Details here.
Vulnerability Report September 2009
This month's report covers three of the Microsoft Tuesday advisories, a remote code execution vulnerability in SMBv2, a vulnerability in the IIS FTP module and information on Dojocon
SMBv2 <air quotes> DoS </air quotes>
Here's the dirty dirty dirt dirt. (All addresses SP2) If you send an SMBv2 packet off to Vista SP1 or SP2 that specifies the NEGOTIATE command, and the ProcessIDHigh word is not set to 0x0000, you do not in fact get a DoS. What happens, is this: (Note that we control eax, a
Rule release for today - September 9, 2009
A quick release for an update to SID 15930 to address the possibility of remote code execution for the Microsoft Windows SMBv2 processing vulnerability. Information is available on snort.org here
Microsoft Tuesday Coverage for September 2009
Microsoft Security Advisory (MS09-045): The Microsoft JScript scripting engine contains a programming error that may allow a remote attacker to execute code on an affected host. Microsoft Security Advisory (MS09-046): The Microsoft DHTML Editing Component ActiveX control contain