Snort rule update for May 2, 2019

Just released:
Snort Subscriber Rule Set Update for May 2, 2019

Cisco Talos just released the newest SNORT® rule set. This release includes 34 new rules, four of which are shared object rules. There are also seven modified rules, one of which is a shared object rules.

This release is the first of a number of additions to the max-detect policy to make it a heavily detection-focused policy. As such, performance will be impacted if this policy is enabled. It's highly recommended that users test this policy's performance before deploying it in production environments. Therefore, there are a large number of modified rules today that could make downloading this set take longer than usual.

There were no changes made to the snort.conf in this release.

Snort rule update for April 30, 2019

Just released:
Snort Subscriber Rule Set Update for April 30, 2019

Cisco Talos just released the newest SNORT® rule set. This release includes 34 new rules, four of which are shared object rules. There are also seven modified rules, one of which is a shared object rules.

This release provides protection from attackers exploiting a zero-day vulnerability in Oracle WebLogic servers. Attackers are exploiting this bug to deliver a new ransomware called "Sodinokibi."

There were no changes made to the snort.conf in this release.

Snort rule update for April 23, 2019

Just released:
Snort Subscriber Rule Set Update for April 23, 2019

Cisco Talos just released the newest SNORT® rule set. This release includes 11 new rules, four of which are shared object rules. There are also 15 modified rules, none of which are shared object rules.

This release provides new coverage for the infamous Emotet malware traditionally spread via spam. There are also two new rules for Microsoft Windows IOleCvt vulnerability disclosed earlier this month as part of Microsoft's monthly security update.

There were no changes made to the snort.conf in this release.

Snort rule update for April 18, 2019

Just released:
Snort Subscriber Rule Set Update for April 18, 2019

Cisco Talos just released the newest SNORT® rule set. This release includes 22 new rules, 11 of which are shared object rules. There are also nine modified rules, none of which are shared object rules.

This release provides coverage for a critical flaw in Cisco's ASR 9000 series of routers. In all, the company disclosed 29 vulnerabilities, but the most serious one had a severity rating of 9.8 out of a possible 10.

Snort blog comments are now disabled

As the topic of the post says, blog comments on this blog are now disabled.

Why?

99% (percentage is entirely made up, but most likely more accurate than non-accurate) of all the comments were spam.  The majority of my time moderating the comments on the blog was spent mashing the "Spam" button.

Every once in awhile a real comment would appear on the blog, and 99% of those comments were answered by me answering with "Go to the mailing lists".

So, in the interest of my sanity, and the fact that the mailing lists provide a better answer and conversational interaction than a blog comment ever could, I've disabled blog comments.

Please direct your questions to the Snort mailing lists: https://www.snort.org/community

Thanks all!

Snort rule update for April 16, 2019

Just released:
Snort Subscriber Rule Set Update for April 16, 2019

Cisco Talos just released the newest SNORT® rule set. This release includes 39 new rules, 12 of which are shared object rules. There are also three modified rules, none of which are shared object rules.

This release provides coverage for a zero-day vulnerability in Microsoft Internet Explorer. This bug could allow an attacker to steal files from a user's machine, even if they are not actively using the web browser.

Applications for 2019 Snort scholarship are now open

Are you a high school student planning on acquiring a college technology degree? Let Snort help you get there.

The Snort Scholarship program is back this year, and once again, we are awarding two $10,000 to two individuals attending an accredited college or university in the 2019-2020 academic year.

You can apply for the scholarship here.

To be eligible for the scholarship, you must:

• Have or be eligible to receive your high school diploma or an equivalent in 2019 as of the date Cisco receives your application.
• Provide reasonable evidence to Cisco that you are seeking a degree in computer science, information technology, computer networking, cybersecurity or a similarly related field of study from a school located in the U.S. or a U.S. territory. 

To apply for the scholarship, you must answer a series of short essay questions, which will be our main basis for how we select the winners. You must submit your application by May 15, 2019.

For more information about contest rules, eligibility requirements, or to complete a submission, visit our Snort Scholarship page.

Snort rule update for April 11, 2019

Just released:
Snort Subscriber Rule Set Update for April 11, 2019

Cisco Talos just released the newest SNORT® rule set. This release includes 33 new rules, two of which are shared object rules. There are also seven modified rules.

In addition to our new rules today, we also have a new version of Snort: 2.9.13.0. Here's a roundup of the new improvements and features.

Snort 2.9.13.0 has been released

Please join us as we welcome SNORTⓇ 2.9.13.0 to the family.

The release notes for the newest version are below:

New Additions

• Snort now supports reload on snort rules update.
• Addition of a scenario to add a packet to blacklist verdict to ensure the new session will be allowed.
• Handled a new pre-processor alert in case of the improper end of t HTTP header.

Improvements

• Modified the calculation of file hash for FTP/HTTP with offset values.
• Fixed portal authentication connection stuck in half closed state.
• Updated UDP global timeout for a non-standard port.

This release also patched the following two vulnerabilities:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-frpwr-smb-snort

As always, we welcome feedback and community participation in Snort on the snort-users mailing list.

Snort rule update for April 9, 2019 — Microsoft Patch Tuesday

Just released:

Snort Subscriber Rule Set Update for April 9, 2019

The newest SNORTⓇ rule set is here from Cisco Talos. In this release, we introduced 80 new rules, eight of which are shared object rules. There are also 10 modified rules.

This release covers Microsoft Patch Tuesday, which included fixes for 74 vulnerabilities. You can read more about the bugs that Microsoft disclosed over at the Talos blog.