Reminder for the 12,000 or so of you that are still on 2.9.6.2...
Its EOL is rapidly approaching (next week), and we should EOL it on 3/7/2016 (Monday).
Meaning, barring anything jarring this week, this Thursday (3/3/2016) should be the last day for Snort 2.9.6.2 builds of the ruleset.
The current version is 2.9.8.0, so, if you haven't upgraded yet, start your engines this week!
Monday, February 29, 2016
Friday, February 26, 2016
Snort++ Update
Pushed build 189 to github (snortadmin/snort3):
16/02/26 - build 189
- snort2lua for dce2 port (in progress)
- replace ppm with latency
- added rule latency
- fixed more address sanitizer bugs
- fixed use of debug vs debug-msgs
- add missing ips option hash and == methods
- perf_monitor configuration
- fix linux + clang build errors
- trough rewrite
16/02/22 - build 188
- added delete/delete[] replacements for no throw overload; thanks to Ramya Potluri for reporting the issue
- fixed a detection option comparison bug which wasted time and space
- disable perf_monitor by default since the reporting interval should be set
- memory manager updates
- valgrind and unsanitary address fixes
- snort2lua updates for dce2
- build issue fix - make non-GNU strerror_r() the default case
- packet latency updates
- perfmon updates
Labels:
3.0,
development,
snort
Thursday, February 25, 2016
Snort Subscriber Rule Set Update for 02/25/2016
Just released:
Snort Subscriber Rule Set Update for 02/25/2016
We welcome the introduction of the newest rule release from Talos. In this release we introduced 5 new rules and made modifications to 6 additional rules.
There were no changes made to the
Talos's rule release:
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Snort Subscriber Rule Set Update for 02/25/2016
We welcome the introduction of the newest rule release from Talos. In this release we introduced 5 new rules and made modifications to 6 additional rules.
There were no changes made to the
snort.conf in this release.Talos's rule release:
Talos has added and modified multiple rules in the browser-ie and server-webapp rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Wednesday, February 24, 2016
Snort Subscriber Rule Set Update for 02/23/2016
Just released:
Snort Subscriber Rule Set Update for 02/23/2016
We welcome the introduction of the newest rule release from Talos. In this release we introduced 111 new rules and made modifications to 54 additional rules.
There were no changes made to the
Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Yaser Mansour
36541
37814
37815
37817
Avery Tarasov
37816
Talos's rule release:
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Snort Subscriber Rule Set Update for 02/23/2016
We welcome the introduction of the newest rule release from Talos. In this release we introduced 111 new rules and made modifications to 54 additional rules.
There were no changes made to the
snort.conf in this release.
Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Yaser Mansour
36541
37814
37815
37817
Avery Tarasov
37816
Talos's rule release:
Talos has added and modified multiple rules in the browser-ie, browser-other, browser-plugins, file-executable, file-flash, file-identify, file-java, file-office, file-other, file-pdf, indicator-obfuscation, indicator-shellcode, malware-cnc, os-solaris, os-windows, policy-other, protocol-imap, server-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Tuesday, February 23, 2016
Snort++ Update
Pushed build 187 to github (snortadmin/snort3):
- added delete/delete[] replacements for no throw overload; thanks to Ramya Potluri for reporting the issue
- fixed a detection option comparison bug which wasted time and space
- disable perf_monitor by default since the reporting interval should be set
- memory manager updates
- valgrind and unsanitary address fixes
- snort2lua updates for dce2
- build issue fix - make non-GNU strerror_r() the default case
- packet latency updates
- perfmon updates
Labels:
3.0,
development,
snort
Thursday, February 18, 2016
Snort Subscriber Rule Set Update for 02/18/2016
Just released:
Snort Subscriber Rule Set Update for 02/18/2016
We welcome the introduction of the newest rule release from Talos. In this release we introduced 54 new rules and made modifications to 120 additional rules.
There were no changes made to the
Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov
37733
Talos's rule release:
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Snort Subscriber Rule Set Update for 02/18/2016
We welcome the introduction of the newest rule release from Talos. In this release we introduced 54 new rules and made modifications to 120 additional rules.
There were no changes made to the
snort.conf in this release.
Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov
37733
Talos's rule release:
Talos has added and modified multiple rules in the browser-firefox, browser-ie, browser-plugins, browser-webkit, exploit-kit, file-executable, file-flash, file-java, file-office, file-other, file-pdf, indicator-obfuscation, malware-cnc, netbios, os-windows, policy-other, protocol-dns, server-apache and sql rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Tuesday, February 16, 2016
Snort Subscriber Rule Set Update for 02/16/2016
Just released:
Snort Subscriber Rule Set Update for 02/16/2016
We welcome the introduction of the newest rule release from Talos. In this release we introduced 11 new rules and made modifications to 11 additional rules.
There were no changes made to the
Talos's rule release:
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Snort Subscriber Rule Set Update for 02/16/2016
We welcome the introduction of the newest rule release from Talos. In this release we introduced 11 new rules and made modifications to 11 additional rules.
There were no changes made to the
snort.conf in this release.Talos's rule release:
Talos has added and modified multiple rules in the browser-plugins, exploit-kit, file-flash, file-office, malware-cnc, malware-tools, netbios, policy-other, protocol-pop and server-webapp rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Saturday, February 13, 2016
Snort Subscriber Rule Set Update for 02/13/2016
Just released:
Snort Subscriber Rule Set Update for 02/13/2016
You're asking "Did you guys just publish a rule release on a Saturday?"
We welcome the introduction of the newest rule release from Talos. In this release we introduced 22 new rules and made modifications to 6 additional rules.
There were no changes made to the
Talos's rule release:
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Snort Subscriber Rule Set Update for 02/13/2016
You're asking "Did you guys just publish a rule release on a Saturday?"
Yes.
We welcome the introduction of the newest rule release from Talos. In this release we introduced 22 new rules and made modifications to 6 additional rules.
There were no changes made to the
snort.conf in this release.Talos's rule release:
Talos has added and modified multiple rules in the browser-plugins, file-flash,
file-java, file-multimedia, file-other, os-windows and server-webapp rule sets
to provide coverage for emerging threats from these technologies.
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Friday, February 12, 2016
Snort++ Update
Pushed build 187 to github (snortadmin/snort3):
- file capture added - initial version writes from packet thread
- added support for http 0.9 to new_http_inspect
- added URI normalization of headers, cookies, and post bodies to new_http_inspect
- configure_cmake.sh updates to better support scripting
- updated catch header (used for some unit tests)
- continued dce2 port
- fixed misc clang and dynamic plugin build issues
- fixed static analysis issues and crash in new_http_inspect
- fixed tcp paws issue
- fixed normalization stats
- fixed issues reported by Bill Parker
- refactoring updates to tcp session
- refactoring updates to profiler
Labels:
3.0,
development,
snort
Thursday, February 11, 2016
Coverage for CVE-2016-1287 in the Snort Subscriber Rule Set
We've been receiving a lot of questions regarding our coverage for the Cisco ASA IKEv1 and IKEv2 Buffer Overflow Vulnerability.
We wanted to let our customers know that we released coverage for this vulnerability on December 1, 2015 in the form of a Shared Object rule. Detection was enabled by default in the balanced policy (on by default for Open Source in the Snort Subscriber Rule Set). Following the patch, yesterday that rule was converted from a Shared Object rule to a plaintext rule and released in the ruleset.
Since this is a modification to an existing rule, and the release date was over 30 days ago, it's available to all Registered users and Subscribers of the Snort Subscriber Rule Set.
As is the case with all of our Shared Object rules, to include the Zero Days that Talos has discovered and disclosed to the appropriate vendors, you'll want to stay up to date as much as possible with the ruleset.
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Thank you!
We wanted to let our customers know that we released coverage for this vulnerability on December 1, 2015 in the form of a Shared Object rule. Detection was enabled by default in the balanced policy (on by default for Open Source in the Snort Subscriber Rule Set). Following the patch, yesterday that rule was converted from a Shared Object rule to a plaintext rule and released in the ruleset.
Since this is a modification to an existing rule, and the release date was over 30 days ago, it's available to all Registered users and Subscribers of the Snort Subscriber Rule Set.
As is the case with all of our Shared Object rules, to include the Zero Days that Talos has discovered and disclosed to the appropriate vendors, you'll want to stay up to date as much as possible with the ruleset.
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!
Thank you!
Subscribe to:
Posts (Atom)