Snort Subscriber Rule Set Update for 11/11/2014
We welcome the introduction of the newest rule release from Talos. In this release we introduced 123 new rules and made modifications to 9 additional rules.
There were no changes made to the
snort.conf in this release.
Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset
Talos's rule release:
Microsoft Security Bulletin MS14-064:
Coding deficiencies exist in Microsoft Windows OLE that may lead to
remote code execution.
A previously released rule will detect attacks targeting these
vulnerabilities and has been updated with the appropriate reference
information. It is included in this release and is identified with GID
1, SID 7070.
New rules to detect attacks targeting these vulnerabilities are also
included in this release and are identified with GID 1, SIDs 32470
through 32473.
Microsoft Security Bulletin MS14-065:
Microsoft Internet Explorer suffers from programming errors that may
lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32424 through 32427,
32430 through 32431, 32436 through 32443, 32458 through 32461, 32476
through 32479, 32481 through 32485, 32491 through 32492, and 32495
through 32500.
Microsoft Security Bulletin MS14-066:
A coding deficiency exists in Microsoft Schannel that may lead to
remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32404 through 32423.
Microsoft Security Bulletin MS14-067:
A coding deficiency exists in Microsoft XML Core Services that may lead
to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32501 through 32502.
Microsoft Security Bulletin MS14-069:
Microsoft Office suffers from programming errors that may lead to
remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32428 through 32429
and 32432 through 32435.
Microsoft Security Bulletin MS14-070:
Programming errors exist in Microsoft TCP/IP that may lead to an
escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32489 through 32490.
Microsoft Security Bulletin MS14-071:
A coding deficiency exists in the Microsoft Windows Audio Service that
may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32518 through 32519.
Microsoft Security Bulletin MS14-072:
A coding deficiency exists in Microsoft .NET Framework that may lead to
an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32474 through 32475.
Microsoft Security Bulletin MS14-073:
A coding deficiency exists in Microsoft SharePoint Foundation that may
lead to an escalation of privilege.
A previously released rule will detect attacks targeting this
vulnerability and has been updated with the appropriate reference
information. It is included in this release and is identified with GID
1, SID 7070.
The VRT has also added and modified multiple rules in the blacklist,
browser-ie, deleted, exploit-kit, file-office, file-other, malware-cnc,
os-windows, policy-other, server-mail and server-webapp rule sets to
provide coverage for emerging threats from these technologies.
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!