How about a readme for the new signing of RVS - 4000 IPS: 1.42 in firmware 1.3.2

Bruce,

You are right.  He left this time by mistake.  We will solve it.  In the meantime, here's what it will be:

RVS4000/WRVS4400N IPS Signature Release Note

Version: 1.42 rules Total: 1097

In this signature, we talked about the exploits/vulnerabilities and applications
as below:

Supported P2P application called BitTorrent up to version 5.0.8.
Supported P2P application named uTorrent up to version 1.7.2.

Version: 1.41 rules Total: 1098

In this signature, we talked about the exploits/vulnerabilities and applications
as below:

-EXPLOIT the MS video control ActiveX Stack Buffer Overflow
A buffer overflow vulnerability exists in Microsoft DirectShow.
The defect is due to the way Microsoft Video ActiveX Control parses image files.
An attacker can convince the user target to open a malicious web page to exploit
This vulnerability.

-EXPLOIT the Injection SQL Oracle database Workspace Manager
Multiple SQL injection vulnerabilities exist in Oracle database server product.
The vulnerabilities are due to inadequate sanitation of input parameters
in the Oracle Workspace Manager component. A remote attacker with user valid
credentials can exploit these vulnerabilities to inject and execute SQL code
with lift is SYS or privilegesof WMSYS.

Supported P2P application named uTorrent up to version 1.7.2.

Content signature for 1.41
========================================================================
Added new signature:
1053635 video MS stack buffer overflow EXPLOIT control ActiveX-1
1053636 video MS stack buffer overflow EXPLOIT control ActiveX-2
1053632 EXPLOIT Oracle database Workspace Manager SQL Injection-1
1053633 EXPLOIT Oracle database Workspace Manager-2 SQL Injection
1053634 EXPLOIT Oracle database Workspace Manager SQL Injection-3

Updated the signature:
1051783 P2P Gnutella Connect
1051212-P2P Gnutella Get file
1051785 P2P Gnutella UDP PING 2
1051997 P2P Gnutella Bearshare with UDP file transfer
1052039 P2P Gnutella OK
Get Foxy P2P file 1052637

Signature removed:
1050521 Worm.Klez.E1 - 1
1050522 Worm.Klez.E1 - 2
1050523 Worm.Klez.E1 - 3
1050524 Worm.Klez.E2 - 1
1050525 Worm.Klez.E2 - 2
1050526 ¡v Worm.Klez.E2 3
1050536 Worm.Blaster.B - 1
1050537 Worm.Blaster.B - 2
1050538 Worm.Blaster.B - 3
1050539 Worm.Blaster.C - 1
1050540 Worm.Blaster.C - 2
1050541 Worm.Blaster.C - 3

Number of rules in each category:
========================================================================
Back/DDoS 51
Buffer overflow: 241
Access control: 92
Scan: 41
Trojan horse: 62
Misc: 3
P2P: 40
Instant Messaging: 121
VRU/worm: 410
Web attacks: 37

Version: 1.40 rules Total: 1091

In this signature, we talked about the exploits/vulnerabilities and applications
as below:

1053406 FEAT MS IE HTML Embed Tag Stack Buffer Overflow (CVE-2008-4261)
An error of border during the processing of a too long file name extension specified
inside a "EMBED" tag can be exploited to cause a stack-based buffer overflow.

1053421 USE MS IE XML Handling Remote Code Execution (CVE-2008-4844)
The vulnerability is due to a use-after-free error when composed
HTML elements are related to the same data source. This can be exploited to
dereference of a pointer released by a specially designed HTML document memory

Version 1.38

In this signature, we addressed the following exploits/vulnerabilities and
applications:

1. support for P2P, BitTorrent and eMule applications.

Version 1.33

In this signature, we addressed the following exploits/vulnerabilities and
applications:

1. support application IM named AIM (http://dashboard.aim.com/aim) until
version 6.5.

2. support application IM called MSN (http://get.live.com/messenger) until
version 8.1.

3 PcShare is a Trojan tool that can remotely administer an attacked computer.

4-CVE-2007-3039: the vulnerability is due to an error of limit in the
Microsoft Message Queuing (MSMQ) service during the treatment of MSMQ messages.
This can be exploited to cause a buffer overflow by sending specially
packages designed for the MSMQ service.

Version 1.32

In this signature, we addressed the following peer-to-peer applications:

1. named IM application PURPOSE up to version 6.5 support.
2. press the request of IM named MSN until version 8.1.

Version 1.31

In this signature, we addressed the following peer-to-peer applications:

1 P2P application called BitTorrent up to version 5.0.8 support.

2. support the P2P application named uTorrent up to version 1.7.2.

Version 1.30

In this version, we have addressed the following vulnerabilities in Microsoft
applications:

1 SUBMISSION-24462: dereference of a pointer Null vulnerability exists in some versions
Microsoft Office.  Remote attackers can trick users into visiting a
specially designed web page.  The symptom includes a denial of
condition of service for the process in question.

2 Microsoft Security Bulletin MS07-027: Microsoft Windows support
Services NMSA Session Description object ActiveX control does not reach
restrict access to dangerous methods. This vulnerability could allow
a remote attacker to execute arbitrary code on an affected system.

Version 1.29

In this version, we have addressed the following exploits/vulnerabilities and
peer-to-peer applications:

1 Microsoft Security Advisory (935423): there is one based on the stack
in Microsoft Windows buffer overflow. The vulnerability is due
for insufficient format validation when handling incorrect ANI
file cursor or icon. A remote attacker can exploit this
vulnerability of prompting grace target user to visit a malicious
Web site by using Internet Explorer. A successful operation would be
allow the execution of arbitrary code with the privileges of the
currently logged in.

2. support a named QQ instant messaging application blocking until the
2007 Beta1 and Beta2 version.

Version 1.28

In this signature, we address the following exploits/vulnerabilities:

Microsoft Security Bulletin MS07-014: there is a buffer overflow
vulnerability in Microsoft Word. The vulnerability is created due to
a flaw in the Table entry of the Section within the structure of Table data flow.
An attacker could exploit this vulnerability by tricking a user to open
a designed Word file. Exploitation of the vulnerability may result
injection and execution of arbitrary code in the security context
the user target.

Microsoft Security Bulletin MS07-016: there is an alteration of the memory
vulnerability in Microsoft Internet Explorer. The flaw is due to a bad
posting lines of response in the responses from the FTP server. By persuading a user
to visit a malicious website, an attacker could run arbitrary on code
the target system with the privileges of the currently logged in user.

Version 1.26

In this signature, we addressed the following exploits/vulnerabilities:

CVE-2006-5559: there is a memory corruption vulnerability in
the ADODB. Connection ActiveX control in Microsoft Internet Explorer.
The flaw is due to improper validation of the data provided to the
Execute method. By persuading target the user to visit a malicious
Web site, an attacker can cause the application process
to terminate or possibly divert its flow of execution to arbitrary
code.

Version 1.25

In this signature, we addressed the following exploits/vulnerabilities:

Microsoft MS06-070 security bulletin: MS Windows 2000 Workstation
Service (WKSSVC. (DLL) has a remote code execution vulnerability. One
unauthenticated attacker could exploit this vulnerability to run
arbitrary code with the privileges of the level system on Windows 2000 and
Windows XP computers.

Version 1.24

In this signature, we addressed the following exploits/vulnerabilities:

1 Microsoft Data Access Components (MDAC) has a remote code execution
vulnerability in the RDS object. DataSpace ActiveX control.  A remote attacker
could create a specially designed and host the malicious file on a
Web site or send it to the victim through e-mail.  When the file is opened,
the attacker can run arbitrary code on the victim's system.

2. control WMI Object Broker ActiveX (WmiScriptUtils.dll) in Microsoft
Visual Studio 2005 has a vulnerability that could allow a remote
attacker to execute arbitrary code.

3 Microsoft Internet Explorer has a type of heap buffer overflow vulnerability.
A remote attacker could create a malicious web page containing COM objects
Daxctle.OCX HTML when instantiated as an ActiveX control and the thing the
victim to open the web page. By this attack, the attacker to execute
arbitrary code on the victim's browser.

Version 1.23

In this version, we have addressed the following exploits/vulnerabilities:

The vulnerability lies in some of the engines in Microsoft XML core
Windows. It is the result of the failure of the engine to properly manage the
bad arguments passed to one of the methods associated with the XML
purpose of the request.

Version 1.22

In this version, we discussed the exploits/vulnerabilities as follows:

Vagaa is a P2P that supports the network BitTorrent and eDonkey software.
It can be downloaded from the two network. The software is mainly used in people's Republic of CHINA.
There are some problems with this software because it didn't follow the official eMule Protocol.
The question can be referenced on the wiki (http://en.wikipedia.org/wiki/Vagaa).
Classify us Vagaa as eDonkey2000 program and allow admin users to disable in the user Web interface.

Version: 1.21

In this version, we have addressed vulnerabilities exploits as below:

Microsoft Internet Explorer WebViewFolderIcon has a buffer overflow
Vulnerability. A remote attacker could create a malicious Web page and
trick the victim to open. By this attack, the attacker could cause buffer
Overflow and crash the browser of the victim.

Version: 1.20

In this version, we discussed the exploits/vulnerabilities and applications
as below:

1 foxy is a P2P application that can search and download music and movies.
Foxy follows most public Gnutella P2P protocol but still has its own
signature under certain conditions. After the inclusion of the file Get Foxy P2P
rule, we can perfectly detect and block the Foxy and it will be detected as Gnutella.
Foxy can be blocked by deactivating Gnutella.

2 Microsoft Internet Explorer 6.0 and 6.0SP1 have impaired memory
vulnerability in the ActiveX component.  A remote attacker can create a
malicious Web page and trick the victim to open the web page. By this attack.
the attacker could cause the crash of the browser of the victim or to execute arbitrary code.

3 Microsoft Internet Explorer has heap buffer overflow vulnerabilities
Vector Markup Language (VML).  A remote attacker can create a malicious Web site
page and the thing the victim to open the web page. By this attack, the attacker
could cause the buffer overflow and execute arbitrary code on the victim's browser.

Version: 1.19

In this version, we have added a rule to meet cross-domain redirect
Microsoft Internet Explorer vulnerability (MS06-042). The vulnerability
is caused by the inappropriate use of URL redirection by the object.documentElement.outer
HTML property. A remote attacker could create a malicious web page and
trick the victim to open the web page. With this attack, the attacker could
run arbitrary code on the victim's browser and get sensitive information.

Version: 1.18

In this version, we have added the 6 rules to facilitate the blocking of QQ, the most
popular instant Messenger in China. There are several versions of QQ on the
official download site. Currently, we can detect and block QQ until the
Version 2006 Sp3 beta 2.

Version: 1.17

In this version, we discussed the exploits/vulnerabilities below:

1. the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, server
2003 and SP1 have a buffer overflow vulnerability. A remote attacker
could exploit a server response designed to cause the buffer overflow and run
arbitrary code on the victim's system.

2 hyperlink Object Library in Microsoft Windows 2000 SP4, XP SP1 and SP2,
Server 2003 and SP1 have a code execution vulnerability. A remote control
attacker could send a malicious Office document containing a
specially designed hyperlink to a victim in an email or host the file on
a web site. When the operator successfully this vulnerability, a remote control
attacker to execute arbitrary code with the privileges of the victim.

3 Microsoft Word XP and Word 2003 have a remote code execution vulnerability.
A remote attacker could host a DOC file on a Web site. If successfully
exploiting this vulnerability, remote attacker could execute arbitrary code
with the privilege of the victim.

Version: 1.16

In this version, we discussed the exploits/vulnerabilities below:

1 Microsoft Excel 2000, XP and 2003 Excel have a remote code execution
vulnerability, due to an error in Excel when incorrect URL handling
channels. A remote attacker could send a malicious .xls file of a victim
in an email or host the file on a web site. When the operator successfully this
vulnerability, a remote attacker to execute arbitrary code with the victim
privileges.

2 hyperlink Object Library in Microsoft Windows 2000 SP4, XP SP1 and SP2,
Server 2003 and SP1 have a code execution vulnerability. A remote control
attacker could send a malicious Office document containing a
specially designed hyperlink to a victim in an email or host the file on
a web site. When the operator successfully this vulnerability, a remote control
attacker to execute arbitrary code with the privileges of the victim.

3 Microsoft Windows XP/NT/2000/2003 have a denial of service vulnerability.
A remote attacker can send a malicious SMB packet causes the victim computers
Crash.

more

Tags: Cisco Support