Blog
Recent
September 29, 2009 13:19

of Pigs and Rockets

It was a quiet day at Sourcefire World Domination Headquarters and somebody wasn't keeping a close eye on the stock of squishy pigs that we give out at trade shows. The VRT had just finished some intensive work and it was a fine Friday afternoon in September. We had some mode

September 24, 2009 13:06

Bamboo -> angel tongue

#include <stdio.h> struct newClass {        char    type;        int     size;        char    *data;        void (*printer)(char*); }; void painter(char *input) {        char buf[4096]; memcpy(buf, input, sizeof(buf)<strlen(input)?sizeof(buf):strlen(input));        r

September 17, 2009 14:13

Rule release for today - September 17, 2009

Maintenance release that adds support for shared object rules for the Snort 2.8.5 release. Also, additions to the web-client, specific-threats, web-misc, misc, oracle and exploit rule sets. More information and changelogs here

September 16, 2009 16:49

Snort 2.8.5 Release

We warned you in the August Vulnerability Report that Snort 2.8.5 was almost ready to be released. Well, today is the day. Snort 2.8.5 is now available for download. All VRT Certified rule releases will now be 2.8.5 compliant and we will cease to support 2.8.4 (in 90 days) in fa

September 15, 2009 19:52

Rule release for today - September 15, 2009

Mostly a maintenance release, we added multiple rules in the specific-threats, dns, web-client, dos, ftp and misc categories. Details here.

September 14, 2009 14:28

Vulnerability Report September 2009

This month's report covers three of the Microsoft Tuesday advisories, a remote code execution vulnerability in SMBv2, a vulnerability in the IIS FTP module and information on Dojocon

September 10, 2009 16:49

SMBv2 <air quotes> DoS </air quotes>

Here's the dirty dirty dirt dirt. (All addresses SP2) If you send an SMBv2 packet off to Vista SP1 or SP2 that specifies the NEGOTIATE command, and the ProcessIDHigh word is not set to 0x0000, you do not in fact get a DoS. What happens, is this: (Note that we control eax, a

September 9, 2009 12:54

Rule release for today - September 9, 2009

A quick release for an update to SID 15930 to address the possibility of remote code execution for the Microsoft Windows SMBv2 processing vulnerability. Information is available on snort.org here

September 8, 2009 14:09

Microsoft Tuesday Coverage for September 2009

Microsoft Security Advisory (MS09-045): The Microsoft JScript scripting engine contains a programming error that may allow a remote attacker to execute code on an affected host. Microsoft Security Advisory (MS09-046): The Microsoft DHTML Editing Component ActiveX control contain