Snort++ Update

Pushed build 174 to github (snortadmin/snort3):

• legacy daemonization cleanup
• decouple -D, -M, -q
• delete -E
• initial rewrite of profiler
• don't create pid file unless requested
• unlink pid lock file
• new_http_inspect header processing, normalization, and decompression tweaks
• convert README to markdown for pretty github rendering (contributed by gavares@gmail.com)
• perfmonitor fixes
• ssl stats updates

Snort Subscriber Rule Set Update for 10/15/2015

Just released:
Snort Subscriber Rule Set Update for 10/15/2015

We welcome the introduction of the newest rule release from Talos. In this release we introduced 35 new rules and made modifications to 5 additional rules.

There were no changes made to the snort.conf in this release.

Talos's rule release:

Talos has added and modified multiple rules in the blacklist, browser-ie, browser-plugins, exploit-kit, file-flash, malware-cnc and server-other rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort 2.9.7.3 EOL is approaching fast!

Just a reminder, the End-Of-Life (EOL) for Snort 2.9.7.3 is approaching fast on 2015-10-20!

If you are one of the 10,000 or so users of Snort 2.9.7.3, please start transitioning your systems to the current release, 2.9.7.6.

As always, please review Snort's EOL policy on Snort.org.  Thanks!

Snort Subscriber Rule Set Update for 10/13/2015, MSTuesday

Just released:
Snort Subscriber Rule Set Update for 10/13/2015

We welcome the introduction of the newest rule release from Talos. In this release we introduced 60 new rules and made modifications to 13 additional rules.

There were no changes made to the snort.conf in this release.

Talos's rule release:

Microsoft Security Bulletin MS15-106:
Microsoft Internet Explorer suffers from programming errors that may lead to
remote code execution.

Previously released rules will detect attacks targeting these vulnerabilities
and have been updated with the appropriate reference information. They are
included in this release and are identified with GID 1, SIDs 34393 through
34394.

New rules to detect attacks targeting these vulnerabilities are also included
in this release and are identified with GID 1, SIDs 36407 through 36414, 36417
through 36422, 36431 through 36432, 36437 through 36444, 36447 through 36448,
36450 through 36451, and 36458 through 36459.

Microsoft Security Bulletin MS15-107:
A coding deficiency exists in Microsoft Edge that may lead to information
disclosure.

A rule to detect attacks targeting this vulnerability is included in this
release and is identified with GID 1, SID 36452.

Microsoft Security Bulletin MS15-108:
A coding deficiency exists in Microsoft JScript and VBScript that may lead to
remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in this
release and are identified with GID 1, SIDs 36419 through 36422.

Microsoft Security Bulletin MS15-109:
A coding deficiency exists in Microsoft Windows Shell that may lead to remote
code execution.

Rules to detect attacks targeting these vulnerabilities are included in this
release and are identified with GID 1, SIDs 36401 through 36402 and 36423
through 36424.

Microsoft Security Bulletin MS15-110:
A coding deficiency exists in Microsoft Office that may lead to remote code
execution.

Rules to detect attacks targeting these vulnerabilities are included in this
release and are identified with GID 1, SIDs 36425 through 36430.

Microsoft Security Bulletin MS15-111:
A coding deficiency exists in the Microsoft Windows Kernel that may lead to an
escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this
release and are identified with GID 1, SIDs 36403 through 36406, 36415 through
36416, and 36445 through 36446.

Talos has also added and modified multiple rules in the browser-ie, browser-plugins, exploit-kit, file-flash, file-multimedia, file-office, file-other, os-windows, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort++ Update

Pushed build 173 to github (snortadmin/snort3):

• added pkt_num rule option to extras
• fix final -> finalize changes for extras
• moved alert_unixsock and log_null to extras
• removed duplicate pat_stats source from extras
• prevent tcp session restart on rebuilt packets (thanks to rmkml for reporting the issue)
• fixed profiler configuration
• fixed ppm event logging
• added filename to reload commands
• fixed -B switch
• reverted tcp syn only logic to match 2X
• ensure ip6 extension decoder state is reset for ip4 too since ip4 packets may have ip6 next proto
• update default manuals

Snort Subscriber Rule Set Update for 10/08/2015

Just released:
Snort Subscriber Rule Set Update for 10/08/2015

We welcome the introduction of the newest rule release from Talos. In this release we introduced 66 new rules and made modifications to 1 additional rule.

There were no changes made to the snort.conf in this release.

Talos's rule release:

Talos has added and modified multiple rules in the blacklist, browser-other, browser-plugins, deleted, exploit-kit, file-flash, malware-cnc, malware-other, os-mobile, os-windows, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort 2.9.8.0 Release Candidate has been released!

Snort 2.9.8 Release Candidate has been posted for download!  Please check out the below release notes:

2015-08-28 - Snort 2.9.8_rc
[*] New additions

 Port override for metadata service in IPS rules.
 SMBv2/SMBv3 support for file inspection.
 AppID Lua detector performance profiling.
 Perfmon dumps stats at fixed intervals from absolute time.
 New preprocessor alert (18:120) to detect SSH tunneling over HTTP
 New config option |disable_replace| to disable replace rule option.
 New Stream configuration |log_asymmetric_traffic| to control logging to syslog.
 New shell script in tools to create simple Lua detectors for AppID.


[*] Improvements

 Added support to differentiate between active and passive FTP connections.
 sfip_t refactored to use struct in6_addr for all ip addresses.
 Post-detection callback for preprocessors.
 AppID support for multiple server/client detectors evaluating on same flow.
 AppID API for DNS packets.
 Memory optimizations throughout.
 Support sending UDP active responses.
 Fix perfmon tracking of pruned packets.
 Stability improvements for AppID.
 Stability improvements for Stream6 preprocessor.
 Added improved support to block malware in FTP preprocessor.
 Improvements done in Stream6 preprocessor to avoid having duplicate packets in the DAQ retry queue.
 Resolved an issue where reputation config incorrectly displayed 'blacklist' in priority field even though 'whitelist' option was configured.

As always, please download, check it out, and provide feedback to the community and developers on the Snort-Users or Snort-Devel lists.

Snort Subscriber Rule Set Update for 10/06/2015

Just released:
Snort Subscriber Rule Set Update for 10/06/2015

We welcome the introduction of the newest rule release from Talos. In this release we introduced 52 new rules and made modifications to 15 additional rules.

There were no changes made to the snort.conf in this release.

Talos's rule release:

Talos has added and modified multiple rules in the blacklist, browser-plugins, exploit-kit, file-flash, file-image, file-office, file-other, file-pdf, malware-cnc, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort++ Build 172 Available Now

Snort++ build 172 is now available on snort.org.  This is the latest monthly update available for download.  You can also get the latest updates from github (snortadmin/snort3) which is updated weekly.

Bug Fixes:

• apply ppm.fastpath config correctly
• fix file_decomp error logic
• enable active response without flow
• fix metadata:service to work like 2x
• fixed issues when building with LINUX_SMP
• fixed frag tracker accounting
• fix Xcode builds
• don't apply cooked verdicts to raw packets
• fixed build error with valgrind build option
• fix breakloop in file daq
• fix plain file processing
• fix detection of stream_user and stream_file data
• fix chunked manual install
• fix OpenBSD build
• fix dev guide builds from top_srcdir
• fixed build of chunked manual (thanks to Bill Parker for reporting the issue)
• fixed cmake build issue with SMP stats enabled
• fixed compiler warnings
• fixed u2spewfoo build issue
• dns bug fix for tcp

Doc Updates:

• update manual related to liblzma
• update bug list
• update where to get dnet
• update usage

Build Changes:

• move extra daqs and extra hext logger to main source tree
• move non-ethernet codecs to extras
• removed unused control socket defines from cmake
• cleanup *FLAGS use in configure.ac
• change configure.ac compiler search order to prefer clang over gcc

Test Changes:

• convert check unit tests to catch
• added --catch-tags [footag],[bartag] for unit test selection
• add cpputest for unit testing

Other Changes:

• implement 116:281 decoder rule
• updated snort2lua
• log innermost proto for type of broken packets
• new_http_inspect cookie processing updates
• updated error messages in u2spewfoo
• added strdup sanity checks (thanks to Bill Parker for reporting the issue)

Please submit bugs, questions, and feedback to bugs@snort.org or the Snort-Users mailing list.

Happy Snorting!

The Snort Release Team

Snort Subscriber Rule Set Update for 10/01/2015

Just released:
Snort Subscriber Rule Set Update for 10/01/2015

We welcome the introduction of the newest rule release from Talos. In this release we introduced 27 new rules and made modifications to 31 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour

36064
36065
36066
36198
36199

Talos's rule release:

Talos has added and modified multiple rules in the blacklist, browser-ie, file-flash, file-identify, file-other, malware-cnc and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!