Sourcefire VRT Certified Snort Rules Update for 04/30/2014

Just released:
Sourcefire VRT Certified Snort Rules Update for 04/30/2014


We welcome the introduction of the newest rule release from the VRT. In this release we introduced 10 new rules and made modifications to 1 additional rules.

There were no changes made to the snort.conf in this release.


In VRT's rule release:

The Sourcefire VRT has added and modified multiple rules in the bad-traffic, malware-cnc and web-misc rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

OpenAppId Webinar is tomorrow!

Announced at RSA, Snort 2.9.7.0 Alpha with the OpenAppID preprocessor, rule keywords and new features: http://blog.snort.org/2014/02/snort-2970-alpha-release-now-available.html have generated an immense amount of interest in the Snort community.

If you aren't familiar with OpenAppId, you can check out all of our posts about the subject here: http://blog.snort.org/search/label/openappid

We wanted to hold a webinar in order for the Open source community to come, see what it's all about, and ask questions about OpenAppId from the developers themselves.

To register for the Webinar, on Thursday, May 1, 2014 at 1pm EDT, please click here.

Sourcefire VRT Certified Snort Rules Update for 04/29/2014

Just released:
Sourcefire VRT Certified Snort Rules Update for 04/29/2014

We welcome the introduction of the newest rule release from the VRT. In this release we introduced 3 new rules and made modifications to 5 additional rules.

There were no changes made to the snort.conf in this release.

In VRT's rule release:

The Sourcefire VRT has added and modified multiple rules in the blacklist, exploit-kit, file-multimedia and os-mobile rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

Sourcefire VRT Certified Snort Rules Update for 04/28/2014, Adobe Flash 0day

Just released:
Sourcefire VRT Certified Snort Rules Update for 04/28/2014


We welcome the introduction of the newest rule release from the VRT. In this release we introduced 54 new rules and made modifications to 4 additional rules.

There were no changes made to the snort.conf in this release.


In VRT's rule release:

CVE-2014-0515: Adobe Flash Player contains a coding deficiency that may lead to remote code execution. 

A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 1, SID 30877. 

The Sourcefire VRT has also added and modified multiple rules in the app-detect, blacklist, browser-ie, exploit-kit, file-flash, file-multimedia and protocol-dns rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

Sourcefire VRT Certified Snort Rules Update for 04/28/2014, Internet Explorer 0day

Just released:
Sourcefire VRT Certified Snort Rules Update for 04/28/2014


We welcome the introduction of the newest rule release from the VRT. In this release we introduced 30 new rules and made modifications to 10 additional rules.

There were changes made to the snort.conf in this release:

The following port(s) were added to stream5 ports_both, http_inspect, and HTTP_PORTS:
9290

The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour
30795
30796
30824
30825
30826
30827
30828
30829
30830
30831
30832
30833
30834
30835
30836
30837
30838
30839
30840
30841
30842

In VRT's rule release:

Microsoft Security Bulletin 2963983: Internet Explorer suffers from programming errors that may lead to remote code execution. 

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 30794 and 30803. 

The Sourcefire VRT has also added and modified multiple rules in the browser-ie, exploit-kit, malware-cnc, protocol-scada and sql rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

Cisco, Linux Foundation, and OpenSSL

Our Cisco colleague Anthony Grieco wrote a quick blog post over on the Cisco Security blog announcing that Cisco is a proud supporter and founder of the Linux Foundation initiative announced on April 24th.

We are pleased to help form a critical mass of governance, funding, and focus that will support the output of open source communities like OpenSSL. By working together as an industry, we can expect greater security, stability, and robustness for components that are critical to the Internet.

Check out the blog article here for further information: http://blogs.cisco.com/security/cisco-linux-foundation-and-openssl/

Sourcefire VRT Certified Snort Rules Update for 04/25/2014

Just released:
Sourcefire VRT Certified Snort Rules Update for 04/25/2014

We welcome the introduction of the newest rule release from the VRT. In this release we introduced 5 new rules and made modifications to 13 additional rules.

There were changes made to the snort.conf in this release:

The following ports were added to HTTP_PORTS, stream5 ports_both, and http_inspect ports:
1942
5000
5600
7778
8333
8344
8983

The

In VRT's rule release:

The Sourcefire VRT has added and modified multiple rules in the app-detect, server-apache and server-webapp rule sets to provide coverage for emerging threats from these technologies. This release includes detection for CVE-2014-0094 and CVE-2014-0112.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

Sourcefire VRT Certified Snort Rules Update for 04/24/2014

Just released:
Sourcefire VRT Certified Snort Rules Update for 04/24/2014


We welcome the introduction of the newest rule release from the VRT. In this release we introduced 12 new rules and made modifications to 6 additional rules.

There were no changes made to the snort.conf in this release.


In VRT's rule release:

The Sourcefire VRT has added and modified multiple rules in the server-other rule set to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

OpenAppId Webinar has been scheduled!

Announced at RSA, Snort 2.9.7.0 Alpha with the OpenAppID preprocessor, rule keywords and new features: http://blog.snort.org/2014/02/snort-2970-alpha-release-now-available.html have generated an immense amount of interest in the Snort community.

If you aren't familiar with OpenAppId, you can check out all of our posts about the subject here: http://blog.snort.org/search/label/openappid

We wanted to hold a webinar in order for the Open source community to come, see what it's all about, and ask questions about OpenAppId from the developers themselves.

To register for the Webinar, on Thursday, May 1, 2014 at 1pm EDT, please click here.

Snort 2.9.4.6 is now EOL for rule support.

Snort 2.9.4.6 is now EOL for rule support.

This means we will no longer be releasing updates for this version of the rule engine. Users of this version are now encouraged to upgrade to the latest version of Snort, which is now Snort 2.9.6.1.

Please review our EOL policy here: https://www.snort.org/eol