Cisco Talos released the latest SNORTⓇ rule update this morning. This is our second rule release since Snort 3 has been officially released. This is a total overhaul of Snort as you know it, so you won't to waste any time switching over. For more information, check out our blog post on the release here and check out the Snort 3 page on Snort.org.
Thursday's release provides several rules to protect against the exploitation of critical remote code execution vulnerabilities in Cisco's SD-WAN solutions. The most serious among the group of vulnerabilities Cisco disclosed this week is one that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system with root privileges.
Here's a breakdown of today's rule release:
| Shared object rules | Modified shared object rules | New rules | Modified rules |
|---|---|---|---|
| 22 | 2 | 5 | 0 |
Talos has added and modified multiple rules in the file-other, malware-cnc, malware-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.
