Cisco Talos (VRT) Update for Sourcefire 3D System

* Talos combines our security experts from TRAC, SecApps, and VRT teams.

Date: 2016-02-18

This SRU number: 2016-02-18-003
Previous SRU number: 2016-02-15-001

Applies to:

This SEU number: 1428
Previous SEU: 1425

Applies to:

This is the complete list of rules modified in SRU 2016-02-18-003 and SEU 1428.

The format of the file is:

GID - SID - Rule Group - Rule Message - Policy State

The Policy State refers to each default Sourcefire policy, Connectivity, Balanced and Security.

The default passive policy state is the same as the Balanced policy state with the exception of alert being used instead of drop.

Note: Unless stated explicitly, the rules are for the series of products listed above.

Updated Rules:

High Priority
GIDSIDRule GroupRule MessagePolicy State
Con.Bal.Sec.
18375BROWSER-PLUGINSQuickTime Object ActiveX clsid accessoffoffoff
19806NETBIOSDCERPC NCACN-IP-TCP brightstor-arc GetGroupStatus overflow attemptoffoffoff
112197SERVER-OTHERCA message queuing server buffer overflow attemptoffoffoff
113287OS-WINDOWSWindows remote kernel tcp/ip igmp vulnerability exploit attemptoffoffoff
115194BROWSER-PLUGINSSizerOne ActiveX function call accessoffoffoff
115478FILE-FLASHAdobe Flash Player invalid object reference code execution attemptoffoffoff
116510BROWSER-PLUGINSMicrosoft Internet Explorer Tabular Control ActiveX overflow by CLSIDoffoffoff
117526FILE-PDFAdobe Acrobat and Adobe Acrobat Reader U3D RHAdobeMeta buffer overflow attemptoffoffoff
118702FILE-OFFICEMicrosoft Office RTF malformed pfragments fieldoffoffdrop
118703FILE-OFFICEMicrosoft Office RTF malformed pfragments fieldoffoffdrop
118704FILE-OFFICEMicrosoft Office RTF malformed second pfragments fieldoffoffdrop
118705FILE-OFFICEMicrosoft Office RTF malformed second pfragments fieldoffoffdrop
118706FILE-OFFICEMicrosoft Office RTF malformed second pfragments fieldoffoffdrop
119151BROWSER-PLUGINSTrend Micro HouseCall ActiveX clsid accessoffoffoff
119152BROWSER-PLUGINSTrend Micro HouseCall ActiveX function call accessoffoffoff
120247FILE-OFFICEMicrosoft Office Outlook SMB attach by reference code execution attemptoffoffdrop
120262BROWSER-IEMicrosoft Internet Explorer onscroll DOS attemptoffoffoff
120264BROWSER-IEMicrosoft Internet Explorer form selection reset attemptoffoffoff
120634BROWSER-IEMicrosoft Internet Explorer onscroll DOS attemptoffoffoff
121077BROWSER-PLUGINSHP Easy Printer Care Software ActiveX function calloffoffoff
121429FILE-PDFPossible unknown malicious PDFoffoffdrop
121453FILE-PDFPossible unknown malicious PDFoffoffdrop
122101FILE-OFFICEMicrosoft Office RTF malformed pfragments fieldoffoffdrop
122102FILE-OFFICEMicrosoft Office RTF malformed pfragments fieldoffoffdrop
123517FILE-PDFAdobe Acrobat Reader libtiff TIFFFetchShortPair stack buffer overflow attemptoffoffdrop
123518FILE-PDFAdobe Acrobat Reader libtiff TIFFFetchShortPair stack buffer overflow attemptoffoffdrop
123520FILE-PDFPossible unknown malicious PDFoffoffdrop
123521FILE-PDFPossible unknown malicious PDFoffoffdrop
123522FILE-PDFAdobe Acrobat Reader malicious TIFF remote code execution attemptoffoffdrop
123523FILE-PDFAdobe Acrobat Reader malformed TIFF remote code execution attemptoffoffdrop
123524FILE-PDFAdobe Acrobat Reader malformed TIFF remote code execution attemptoffoffdrop
123611FILE-PDFJavaScript contained in an xml template embedded in a pdf attemptoffoffdrop
123612FILE-PDFJavaScript contained in an xml template embedded in a pdf attemptoffoffdrop
125393FILE-OFFICEMicrosoft Office RTF malformed pfragments fieldoffoffdrop
125475FILE-PDFJavaScript contained in an xml template embedded in a pdf attemptoffoffdrop
125779FILE-EXECUTABLEMicrosoft Windows Authenticode signature verification bypass attemptoffoffdrop
125832FILE-JAVAOracle Java JMX class arbitrary code execution attemptoffdropdrop
126592BROWSER-WEBKITApple Safari Webkit libxslt arbitrary file creation attemptoffoffoff
126824SERVER-OTHERApache Struts allowStaticMethodAccess invocation attemptoffdropdrop
127822FILE-OTHERMicrosoft Windows XP .theme file remote code execution attemptoffdropdrop
128303FILE-PDFAdobe Acrobat and Adobe Acrobat Reader U3D RHAdobeMeta buffer overflow attemptoffoffoff
128626FILE-PDFAdobe Acrobat and Adobe Acrobat Reader U3D RHAdobeMeta buffer overflow attemptoffoffoff
128887FILE-PDFAdobe Acrobat Reader malformed TIFF remote code execution attemptoffoffdrop
128888FILE-PDFAdobe Acrobat Reader malformed TIFF remote code execution attemptoffoffdrop
128889FILE-PDFAdobe Acrobat Reader malformed TIFF remote code execution attemptoffoffdrop
128890FILE-PDFAdobe Acrobat Reader malformed TIFF remote code execution attemptoffoffdrop
129213INDICATOR-OBFUSCATIONpotential math library debuggingoffdropdrop
129394BROWSER-WEBKITApple WebKit QuickTime plugin content-type http header buffer overflow attemptoffoffoff
129622FILE-PDFAdobe Acrobat Reader malformed shading modifier heap corruption attemptoffoffoff
129749BROWSER-PLUGINSSizerOne 2 ActiveX clsid accessoffoffdrop
129859SERVER-APACHEApache Struts allowStaticMethodAccess invocation attemptoffdropdrop
130153FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via MIME HTML document attemptoffdropdrop
130154FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via MIME HTML document attemptoffdropdrop
130155FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via MIME HTML document attemptoffdropdrop
130156FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via MIME HTML document attemptoffdropdrop
130157FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via MIME HTML document attemptoffdropdrop
130158FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via MIME HTML document attemptoffdropdrop
130159FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via MIME HTML document attemptoffdropdrop
130160FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via MIME HTML document attemptoffdropdrop
130161FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via malicious MSComctlLib object attemptoffdropdrop
130162FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via malicious MSComctlLib xls object attemptoffoffdrop
130163FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via malicious MSComctlLib object attemptoffdropdrop
130164FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via malicious MSComctlLib xls object attemptoffoffdrop
130165FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via malicious toolbar and author attemptoffdropdrop
130166FILE-OFFICEMicrosoft Windows common controls stack buffer overflow via malicious toolbar and author attemptoffdropdrop
130754FILE-FLASHAdobe Flash malformed regular expression exploit attemptoffdropdrop
130755FILE-FLASHAdobe Flash malformed regular expression exploit attemptoffdropdrop
330901FILE-FLASHknown malicious flash actionscript decryption routineoffoffdrop
131686FILE-PDFAdobe Acrobat Reader X XML forms specially crafted RLE8 format BMP integer overflow attemptdropdropdrop
131687FILE-PDFAdobe Acrobat Reader X XML forms specially crafted RLE8 format BMP integer overflow attemptoffdropdrop
131926FILE-OFFICEMicrosoft Windows common controls MSCOMCTL.OCX buffer overflow attemptoffdropdrop
131927FILE-OFFICEMicrosoft Windows common controls MSCOMCTL.OCX buffer overflow attemptoffdropdrop
132353SQLDrupal 7 pre auth SQL injection attemptoffoffdrop
132360FILE-FLASHAdobe Flash Player worker shared object use-after-free attemptoffdropdrop
132730FILE-OTHERMicrosoft Windows XP .theme file remote code execution attemptoffdropdrop
132857FILE-OFFICEMicrosoft Windows common controls MSCOMCTL.OCX buffer overflow attemptoffdropdrop
132858FILE-OFFICEMicrosoft Windows common controls MSCOMCTL.OCX buffer overflow attemptoffdropdrop
132859FILE-OFFICEMicrosoft Windows common controls MSCOMCTL.OCX buffer overflow attemptoffdropdrop
132860FILE-OFFICEMicrosoft Windows common controls MSCOMCTL.OCX buffer overflow attemptoffdropdrop
132861FILE-OFFICEMicrosoft Windows common controls MSCOMCTL.OCX buffer overflow attemptoffdropdrop
132862FILE-OFFICEMicrosoft Windows common controls MSCOMCTL.OCX buffer overflow attemptoffdropdrop
132863FILE-OFFICEMicrosoft Windows common controls MSCOMCTL.OCX buffer overflow attemptoffdropdrop
134389FILE-OTHERMicrosoft Journal out of bounds read attemptoffdropdrop
134390FILE-OTHERMicrosoft Journal out of bounds read attemptoffdropdrop
135266FILE-FLASHAdobe Flash Player remote code execution attemptoffoffdrop
135449FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
135450FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
135451FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
135452FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
135453FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
135454FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
135538POLICY-OTHEREMC AutoStart ftagent insecure opcode 20 subcode 2060 access attemptoffoffoff
135539POLICY-OTHEREMC AutoStart ftagent insecure opcode 20 subcode 2219 access attemptoffoffoff
135540SERVER-OTHEREMC AutoStart ftagent SQL injection attemptoffdropdrop
135541SERVER-OTHEREMC AutoStart ftagent SQL injection attemptoffdropdrop
136116BROWSER-PLUGINSHP LoadRunner ActiveX clsid access attemptoffoffoff
136117BROWSER-PLUGINSHP LoadRunner ActiveX clsid access attemptoffoffoff
136118BROWSER-PLUGINSHP LoadRunner ActiveX clsid access attemptoffoffoff
136119BROWSER-PLUGINSHP LoadRunner ActiveX clsid access attemptoffoffoff
136124FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
136126FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
136127FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
136128FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
136129FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
136158SERVER-OTHERHP OpenView Storage Data Protector arbitrary command execution attemptoffdropdrop
136771EXPLOIT-KITAngler exploit kit viewforum uri request attemptoffoffdrop
136819FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
136820FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
136821FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
136822FILE-FLASHAdobe Flash Player AS3 opaqueBackground use-after-free attemptoffdropdrop
137626BROWSER-FIREFOXMozilla Firefox IDL fragment privilege escalation attemptoffdropdrop
137629FILE-FLASHAdobe Flash Player dangling bytearray pointer code execution attemptoffdropdrop
137630FILE-FLASHAdobe Flash Player dangling bytearray pointer code execution attemptoffdropdrop
137631FILE-FLASHAdobe Flash Player dangling bytearray pointer code execution attemptoffdropdrop
137632FILE-FLASHAdobe Flash Player dangling bytearray pointer code execution attemptoffdropdrop
137633BROWSER-IEMicrosoft Internet Explorer CTextElement use after free attemptoffdropdrop
137645FILE-FLASHAdobe Flash copyPixelsToByteArray integer overflow attemptdropdropdrop
137650FILE-OTHERCA BrightStor stack buffer overflow attemptoffoffoff
Medium Priority
GIDSIDRule GroupRule MessagePolicy State
Con.Bal.Sec.
130327INDICATOR-OBFUSCATIONmultiple binary tags in close proximity - potentially maliciousoffoffoff
130328INDICATOR-OBFUSCATIONmultiple binary tags in close proximity - potentially maliciousoffoffoff