Sourcefire VRT Certified Snort Rules Update 2011-04-12

[Research <research () sourcefire com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Sourcefire VRT Certified Snort Rules Update

Synopsis:
The Sourcefire VRT is aware of vulnerabilities affecting products from
Microsoft Inc. and Adobe Systems Inc.

Details:
Microsoft Security Advisory MS11-018:
Microsoft Internet Explorer contains programming errors that may allow
a remote attacker to execute code on an affected system.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 3, SIDs 18646 and 18669
through 18671.

Microsoft Security Advisory MS11-019:
The Microsoft implementation of the Common Internet Filing System
(CIFS) contains programming errors that may allow a remote attacker to
execute code on an affected system.

Previously released rules will detect attacks targeting these
vulnerabilities and are included in this release with updated reference
information, and are identified with GID 3, SID 16631 and GID 1, SID
18462. 

Microsoft Security Advisory MS11-020:
The Microsoft implementation of the Common Internet Filing System
(CIFS), specifically the Server Message Block (SMB) portion, contains
programming errors that may allow a remote attacker to execute code on
an affected system.

A rule to detect attacks targeting this vulnerability is included in
this release and is identified with GID 3, SID 18660.

Microsoft Security Advisory MS11-021:
Microsoft Excel contains programming errors that may allow a remote
attacker to execute code on an affected system.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 3, SIDs 18630 through 18634,
18639 through 18641 and 18676.

Microsoft Security Advisory MS11-022:
Microsoft PowerPoint contains programming errors that may allow a
remote attacker to execute code on an affected system.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 3, SIDs 18635 through 18637.

Microsoft Security Advisory MS11-023:
Microsoft Office contains programming errors that may allow a remote
attacker to execute code on an affected system.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 3, SIDs 18638, 18647 and
18650.

Microsoft Security Advisory MS11-024:
The Microsoft Fax Cover Page Editor contains a programming error that
may allow a remote attacker to execute code on an affected system.

A rule to detect attacks targeting this vulnerability is included in
this release and is identified with GID 3, SID 18673.

Microsoft Security Advisory MS11-025:
The Microsoft Foundation Class Library (MFC) contains programming
errors that may allow a remote attacker to execute code on an affected
system via applications compiled using these libraries.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 3, SIDs 18619 through 18629.

Microsoft Security Advisory MS11-026:
The Microsoft implementation of MIME HTML (MHTML) contains programming
errors that may allow a remote attacker to execute code on an affected
system via a cross-site scripting attack.

A previously released rule will detect attacks targeting this
vulnerability and is included in this release with updated reference
information, it is identified with GID 1, SID 18335.

Microsoft Security Advisory MS11-027:
Microsoft Internet Explorer, when using ActiveX controls, contains
programming errors that may allow a remote attacker to execute code on
an affected system.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 3, SIDs 18668 and 18672.

Additionally, previously released rules will detect attacks targeting
these vulnerabilities and are included in this release with updated
reference information; they are identified with GID 1, SIDs 18241,
18242 and 18329.

Microsoft Security Advisory MS11-028:
The Microsoft .Net implementation contains a programming error that may
allow a remote attacker to execute code on an affected system.

A rule to detect attacks targeting this vulnerability is included in
this release and is identified with GID 3, SID 18624.

Microsoft Security Advisory MS11-029:
The Microsoft Graphics Device Interface (GDI) contains a programming
error that may allow a remote attacker to execute code on an affected
system.

A rule to detect attacks targeting this vulnerability is included in
this release and is identified with GID 3, SID 18645.

Microsoft Security Advisory MS11-030:
The Microsoft implementation of the Domain Name System (DNS),
specifically when handling the Link-local Multicast Name Resolution
(LLMNR) protocol, contains a programming error that may allow a remote
attacker to execute code on an affected system.

A rule to detect attacks targeting this vulnerability is included in
this release and is identified with GID 3, SID 18655.

Microsoft Security Advisory MS11-032:
The Microsoft implementation for handling Open-Type fonts contains a
programming error that may allow a remote attacker to execute code on
an affected system.

A rule to detect attacks targeting this vulnerability is included in
this release and is identified with GID 3, SID 18644.

Microsoft Security Advisory MS11-033:
The Microsoft Office Word Converter contains programming errors that
may allow a remote attacker to execute code on an affected system.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 3, SIDs 18642 and 18643.

Microsoft Security Advisory MS11-034:
The Microsoft Windows Operating System contains programming errors that
may allow an attacker to escalate privileges on an affected host.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 3, SIDs 18661 through 18667.

Adobe Security Advisory APSA11-02:
Adobe Flash Player contains a programming error that may allow a remote
attacker to execute code on an affected system.

A previously released rule will detect attacks targeting this
vulnerability and is identified with GID 1, SID 18546.

For a complete list of new and modified rules please see:

http://www.snort.org/vrt/docs/ruleset_changelogs/changes-2011-04-12.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFNpI7+QcQOxItLLaMRAvCtAJ9vOZJy78ITm0hsPVldOb56v5HJoQCfQFoa
ezGzKhpN7iXUQRS0WdQRxzw=
=gROc
-----END PGP SIGNATURE-----


------------------------------------------------------------------------------
Forrester Wave Report - Recovery time is now measured in hours and minutes
not days. Key insights are discussed in the 2010 Forrester Wave Report as
part of an in-depth evaluation of disaster recovery service providers.
Forrester found the best-in-class provider in terms of services and vision.
Read this report now!  http://p.sf.net/sfu/ibm-webcastpromo
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org