Snort Subscriber Rule Set Update for 12/09/2014
We welcome the introduction of the newest rule release from Talos. In this release we introduced 51 new rules and made modifications to 3 additional rules.
There were no changes made to the
snort.conf in this release.Talos's rule release:
Talos is aware of vulnerabilities affecting products from Microsoft
Corporation.
Details:
Microsoft Security Bulletin MS14-075:
Coding deficiencies exist in Microsoft Exchange Server that may lead to
an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32681 through 32682
and 32705.
Microsoft Security Bulletin MS14-080:
Microsoft Internet Explorer suffers from programming errors that may
lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32679 through 32680,
32685 through 32686, 32689 through 32694, 32703 through 32704, 32709
through 32710, 32713 through 32717, and 32720 through 32725.
Microsoft Security Bulletin MS14-081:
Programming errors exist in Microsoft Word and Microsoft Office Web
Apps that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32707 through 32708
and 32711 through 32712.
Microsoft Security Bulletin MS14-082:
A coding deficiency exists in Microsoft Office that may lead to remote
code execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32687 through 32688.
Microsoft Security Bulletin MS14-083:
A coding deficiency exists in Microsoft Excel that may lead to remote
code execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32683 through 32684
and 32718 through 32719.
Microsoft Security Bulletin MS14-084:
A coding deficiency exists in Microsoft VBScript scripting engine that
may lead to remote code execution.
A rule to detect attacks targeting this vulnerability is included in
this release and is identified with GID 1, SID 32709.
Microsoft Security Bulletin MS14-085:
A coding deficiency exists in Microsoft Graphics Component that may
lead to information disclosure.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32695 through 32702.
Talos has also added and modified multiple rules in the blacklist,
browser-ie, browser-other, deleted, file-office, malware-cnc,
os-windows and server-webapp rule sets to provide coverage for emerging
threats from these technologies.
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!