Snort.org restoration

We are still experiencing some problems with certain aspects of Snort.org, however, for most things (such as rule downloads) should be in proper functioning order.  I'll keep you posted on the status of the site.

Thanks for being patient.

Continuing Snort.org problems

We are still experiencing problems with account creation, signup, and rule downloads.  Please be patient with us as our web team works to resolve the problem.

Some current Snort.org errors

We are getting reports of 500 errors when trying to sign up on Snort.org.  Thank you.

We're aware of the issue and the site is currently undergoing some maintenance to make things faster and sustainable for the long term.

I'll update the blog when things seem to be resolved.

Decommissioning of the CVS Server at Snort.org

For years we've had a underused CVS server at the location of cvs.snort.org.  While going back through our assets and taking a look at what we were using and not using, we noticed that cvs.snort.org was barely used.  The server was very old and ran an older OS, so at this point it was becoming more of a liability to keep it up.

This wasn't even a live CVS server and it was only synced when we did a Snort release.

In fact, the only time it was ever used was when people Google a phrase and wind up in the code repository to reference something on a Snort list.  Since the posting of the manual at http://manual.snort.org I felt the server was unneeded and it is now in the process of being decommissioned.  In fact, it's already been brought down.

If people still need the CVS, let me know, and we will explore ways to make the code public in a CVS form again.  You can still download the full source code of Snort at http://www.snort.org/snort-downloads.

VRT Rule Update for 2/21/2012

Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 60 new rules and made modifications to 12 additional rules.

 There were no changes made to the snort.conf in this release.

We'd like to than Nathan for his contributions on sid:21375

 In VRT's rule release:

Synopsis: This release adds and modifies rules in several categories. Details: The Sourcefire VRT has added and modified multiple rules in the backdoor, blacklist, botnet-cnc, deleted, exploit, file-identify, netbios, oracle, specific-threats, spyware-put, web-activex, web-client and web-php rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

VRT Rule Update for 02/17/2012

Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 44 new rules and made modifications to 16 additional rules.

 There were no changes made to the snort.conf in this release.

 In VRT's rule release:

Synopsis: This release adds and modifies rules in several categories. Details: The Sourcefire VRT has added and modified multiple rules in the bad-traffic, blacklist, botnet-cnc, exploit, netbios, oracle, policy, specific-threats and web-misc rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

VRT Rule Release for 02/14/2012

Sorry for the delay in getting the blog post out, I've been in meetings. Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 44 new rules and made modifications to 28 additional rules. There were no changes made to the snort.conf in this release. In VRT's rule release:

Synopsis: The Sourcefire VRT is aware of vulnerabilities affecting Microsoft products. 

Details: Microsoft Security Advisory MS12-008: Apple Safari running on 64-bit Microsoft Windows systems suffers from a programming error that may allow a remote attacker to execute code on an affected system. 

A previously released rule identified with GID 1, SID 20999 has been updated with the relevant reference information and is included in this release. 

Microsoft Security Advisory MS12-010: Microsoft Internet Explorer contains programming errors that may allow a remote attacker to execute code on a vulnerable system. 

Rules to detect these attacks are included in this release and are identified with GID 1, SIDs 21292 and 21300. 

Microsoft Security Advisory MS12-011: Microsoft SharePoint suffers from programming errors that may allow a remote attacker to execute a cross-site scripting attack using a vulnerable system. 

Rules to detect these attacks are included in this release and are identified with GID 1, SIDs 21297 and 21298. Additionally, a previously released rule identified with GID 1, SID 20258 will also detect attempts to leverage this vulnerability and is included in this release with updated reference information. 

Microsoft Security Advisory MS12-012: The Microsoft Color Control Panel application suffers from a programming error that may allow a remote attacker to execute code on an affected system. 

Rules to detect attacks targeting this vulnerability are included in this release and are identified with GID 1, SIDs 21289 and 21290. 

Microsoft Security Advisory MS12-013: The Microsoft Windows operating system suffers from a programming error that may allow a remote attacker to execute code on an affected system. 

A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 1, SID 21308. 

Microsoft Security Advisory MS12-014: The Microsoft Windows Indeo Filter contains a programming error that may allow a remote attacker to execute code on an affected system. 

Previously released rules identified with GID 1, SIDs 18531 and 18532 will detect attacks targeting this vulnerability and are included in this release with updated reference information. 

Microsoft Security Advisory MS12-015: Microsoft Visio contains programming errors that may allow a remote attacker to execute code on an affected system. 

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 21291, 21293, 21301, 21302 and 21307. 

Microsoft Security Advisory MS12-016: Microsoft Silverlight contains programming errors that may allow a remote attacker to execute code on an affected system. 

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 21299 and 21305. 

Additionally, the Sourcefire VRT has added and modified multiple rules in the backdoor, blacklist, botnet-cnc, dos, exploit, file-identify, netbios, policy, specific-threats, web-activex and web-misc rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!