Re: Snort Subscriber Rules Update 2026-06-04
Jonathan Lee via Snort-sigs <[email protected]> Sat, 6 Jun 2026 10:20:38 -0700
| Newsgroups | gmane.comp.security.ids.snort.sigs |
|---|---|
| Message-ID | <[email protected]> |
--===============3577968588696873900== Content-Type: multipart/alternative; boundary="Apple-Mail=_4B4ED935-DCE9-4F12-BB80-BC26787DD6A2" --Apple-Mail=_4B4ED935-DCE9-4F12-BB80-BC26787DD6A2 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hello Snort Team ET issued a bug last night and it was cause the engine = to not start.=20 Issue Summary: Following the automated nightly rule update, the Snort service on the = WAN interface crashed and failed to start. The issue was caused by two = separate syntax errors introduced upstream in last night's Emerging = Threats (ET) rule package release. Technical Details & Root Causes: Rule SID 2054074 (ET EXPLOIT Kingdee Cloud Star Deserialization): The = rule authors introduced a logical paradox in the destination target = field ([$EXTERNAL_NET,$HTTP_SERVERS]). Because our firewall defines = $EXTERNAL_NET as a negation (!$HOME_NET), Snort encountered an = unresolvable routing loop and threw a fatal compilation error. Rule SID 2033776 (ET TROJAN NSO Group Pegasus Related Data Exfil): This = rule contained a malformed regular expression (PCRE parsing conflict) = that broke the trailing option block, causing Snort to drop the rule's = closing parenthesis and crash on line 10111. Resolution Action Taken: The interface configuration was safely isolated and paused. SID 2054074 Fix: Manually corrected the broken variable logic by = swapping the conflicting $EXTERNAL_NET reference to $HOME_NET, allowing = the engine to mathematically resolve the network paths cleanly. SID 2033776 Fix: Cleaned up the broken trailing regular expression = string parameters to satisfy the parser. The rules file was updated, and the interface was toggled back on. Current Status: The Snort engine has successfully verified the = configurations, compiled the rule chains, and is now fully active and = running on the WAN interface. No further action is required unless a = subsequent rule update overwrites these manual patches before the vendor = pushes official fixes. > On Jun 4, 2026, at 06:46, Research via Snort-sigs = <[email protected]> wrote: >=20 > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 >=20 >=20 > Talos Snort Subscriber Rules Update >=20 > Synopsis: > This release adds and modifies rules in several categories. >=20 > Details: > Talos has added and modified multiple rules in the file-identify, > file-other, server-apache and server-webapp rule sets to provide > coverage for emerging threats from these technologies. >=20 >=20 > For a complete list of new and modified rules please see: >=20 > https://www.snort.org/advisories > -----BEGIN PGP SIGNATURE----- >=20 > iQIcBAEBAgAGBQJqIYGYAAoJEHB/DbSAg2dxiJUP+wXWvUgWICWGYpOFv/OcJ7RR > FLIKNbD6ESeD7s5BrZ4ayH2dHkgC9oAW4xMnfMeqI7SF3qup8YH09iMpQ60Qxg0s > WXII0CAGgFufoK4YG8X0qLNPxZHig94F+y6hUx/Xert6EU/AjCeNLJTW0es0INbU > OSOzuHOod3JCJQPf6Swd7wkjxJ2yQuW4zvZ5T0XloiDMWkcD+b8LtuNrRa/MeUo0 > L8CWFJs7JQixQ+seYMy53SLITbKp5Lsl8+LDV8jSs/+SHpB4mQigLn+Mg+yr3v7H > JK583APs81RddpRN/aeCMVuJ64dnFZ6Am05Azx3Q5U3oabHDwgA26Ma2CYo+1m7j > 2O+buB6KA7PbiZdaT+uAV3iaHOm/j1h+yFvEPoWBGg60vhHWu239fIKzkXEJG6ge > s0ZsCm0T8ysglJGoJxmX9RnI4WaG3en9706nTdL/iZV1/7/Jl++13MaA90ZA0FWW > xze4DkygTeKx6edKHXk4Locrmo2kkDMfbHukxIaNJafvAEkK6iOPxkWD3BNmDmLG > 0PGrDPPR+3GPScAYi7yhofQ6xl/8xmsBGiDW3ZdTdFQB2pZELVJm9MseGJgAQq0f > e3fB1cRiY4QdJTC/zpI4dhr37vp8F9kqRuT3RggPTqOOLCU5HOOKVbCB8wCIDdzG > iwuJTeZOfFvjMPgWBCCP > =3DHk6+ > -----END PGP SIGNATURE----- >=20 > _______________________________________________ > Snort-sigs mailing list > [email protected] > https://lists.snort.org/mailman/listinfo/snort-sigs >=20 > Please visit http://blog.snort.org for the latest news about Snort! >=20 > Please follow these rules: = https://snort.org/faq/what-is-the-mailing-list-etiquette >=20 > Visit the Snort.org to subscribe to the official Snort ruleset, make = sure to stay up to date to catch the most <a href=3D" = https://snort.org/downloads/#rule-downloads">emerging threats</a>! --Apple-Mail=_4B4ED935-DCE9-4F12-BB80-BC26787DD6A2 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii <html aria-label=3D"message body"><head><meta http-equiv=3D"content-type" = content=3D"text/html; charset=3Dus-ascii"></head><body = style=3D"overflow-wrap: break-word; -webkit-nbsp-mode: space; = line-break: after-white-space;"><p dir=3D"auto" style=3D"box-sizing: = border-box; margin-top: 0px; margin-bottom: 1rem; caret-color: rgb(33, = 37, 41); color: rgb(33, 37, 41); font-family: -apple-system, = BlinkMacSystemFont, "Segoe UI", "Helvetica Neue", = Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe = UI Emoji", "Segoe UI Symbol"; font-size: 14px;"><span = style=3D"box-sizing: border-box;"><b>Hello Snort Team ET issued a bug = last night and it was cause the engine to not = start. </b></span></p><p dir=3D"auto" style=3D"box-sizing: = border-box; margin-top: 0px; margin-bottom: 1rem; caret-color: rgb(33, = 37, 41); color: rgb(33, 37, 41); font-family: -apple-system, = BlinkMacSystemFont, "Segoe UI", "Helvetica Neue", = Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe = UI Emoji", "Segoe UI Symbol"; font-size: 14px;"><span = style=3D"box-sizing: border-box;"><b><br></b></span></p><p dir=3D"auto" = style=3D"box-sizing: border-box; margin-top: 0px; margin-bottom: 1rem; = caret-color: rgb(33, 37, 41); color: rgb(33, 37, 41); font-family: = -apple-system, BlinkMacSystemFont, "Segoe UI", "Helvetica = Neue", Helvetica, Arial, sans-serif, "Apple Color Emoji", = "Segoe UI Emoji", "Segoe UI Symbol"; font-size: = 14px;"><span style=3D"box-sizing: border-box;"><b>Issue = Summary:</b></span><br style=3D"box-sizing: border-box;">Following the = automated nightly rule update, the Snort service on the WAN interface = crashed and failed to start. The issue was caused by two separate syntax = errors introduced upstream in last night's Emerging Threats (ET) rule = package release.</p><p dir=3D"auto" style=3D"box-sizing: border-box; = margin-top: 0px; margin-bottom: 1rem; caret-color: rgb(33, 37, 41); = color: rgb(33, 37, 41); font-family: -apple-system, BlinkMacSystemFont, = "Segoe UI", "Helvetica Neue", Helvetica, Arial, = sans-serif, "Apple Color Emoji", "Segoe UI Emoji", = "Segoe UI Symbol"; font-size: 14px;"><span style=3D"box-sizing: = border-box;">Technical Details & Root Causes:</span></p><ol = style=3D"box-sizing: border-box; padding-left: 2rem; margin-top: 0px; = margin-bottom: 1rem; caret-color: rgb(33, 37, 41); color: rgb(33, 37, = 41); font-family: -apple-system, BlinkMacSystemFont, "Segoe = UI", "Helvetica Neue", Helvetica, Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe = UI Symbol"; font-size: 14px;"><li style=3D"box-sizing: = border-box;"><span style=3D"box-sizing: border-box;">Rule SID 2054074 = (ET EXPLOIT Kingdee Cloud Star Deserialization):</span> The rule = authors introduced a logical paradox in the destination target field = ([$EXTERNAL_NET,$HTTP_SERVERS]). Because our firewall defines = $EXTERNAL_NET as a negation (!$HOME_NET), Snort encountered an = unresolvable routing loop and threw a fatal compilation error.</li><li = style=3D"box-sizing: border-box;"><span style=3D"box-sizing: = border-box;">Rule SID 2033776 (ET TROJAN NSO Group Pegasus Related Data = Exfil):</span> This rule contained a malformed regular expression = (PCRE parsing conflict) that broke the trailing option block, causing = Snort to drop the rule's closing parenthesis and crash on line = 10111.</li></ol><p dir=3D"auto" style=3D"box-sizing: border-box; = margin-top: 0px; margin-bottom: 1rem; caret-color: rgb(33, 37, 41); = color: rgb(33, 37, 41); font-family: -apple-system, BlinkMacSystemFont, = "Segoe UI", "Helvetica Neue", Helvetica, Arial, = sans-serif, "Apple Color Emoji", "Segoe UI Emoji", = "Segoe UI Symbol"; font-size: 14px;"><span style=3D"box-sizing: = border-box;">Resolution Action Taken:</span></p><p dir=3D"auto" = style=3D"box-sizing: border-box; margin-top: 0px; margin-bottom: 1rem; = caret-color: rgb(33, 37, 41); color: rgb(33, 37, 41); font-family: = -apple-system, BlinkMacSystemFont, "Segoe UI", "Helvetica = Neue", Helvetica, Arial, sans-serif, "Apple Color Emoji", = "Segoe UI Emoji", "Segoe UI Symbol"; font-size: = 14px;">The interface configuration was safely isolated and paused.</p><p = dir=3D"auto" style=3D"box-sizing: border-box; margin-top: 0px; = margin-bottom: 1rem; caret-color: rgb(33, 37, 41); color: rgb(33, 37, = 41); font-family: -apple-system, BlinkMacSystemFont, "Segoe = UI", "Helvetica Neue", Helvetica, Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe = UI Symbol"; font-size: 14px;"><span style=3D"box-sizing: = border-box;">SID 2054074 Fix:</span> Manually corrected the broken = variable logic by swapping the conflicting $EXTERNAL_NET reference to = $HOME_NET, allowing the engine to mathematically resolve the network = paths cleanly.</p><p dir=3D"auto" style=3D"box-sizing: border-box; = margin-top: 0px; margin-bottom: 1rem; caret-color: rgb(33, 37, 41); = color: rgb(33, 37, 41); font-family: -apple-system, BlinkMacSystemFont, = "Segoe UI", "Helvetica Neue", Helvetica, Arial, = sans-serif, "Apple Color Emoji", "Segoe UI Emoji", = "Segoe UI Symbol"; font-size: 14px;"><span style=3D"box-sizing: = border-box;">SID 2033776 Fix:</span> Cleaned up the broken trailing = regular expression string parameters to satisfy the parser.</p><p = dir=3D"auto" style=3D"box-sizing: border-box; margin-top: 0px; = margin-bottom: 1rem; caret-color: rgb(33, 37, 41); color: rgb(33, 37, = 41); font-family: -apple-system, BlinkMacSystemFont, "Segoe = UI", "Helvetica Neue", Helvetica, Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe = UI Symbol"; font-size: 14px;">The rules file was updated, and the = interface was toggled back on.</p><p dir=3D"auto" style=3D"box-sizing: = border-box; margin-top: 0px; margin-bottom: 1rem; caret-color: rgb(33, = 37, 41); color: rgb(33, 37, 41); font-family: -apple-system, = BlinkMacSystemFont, "Segoe UI", "Helvetica Neue", = Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe = UI Emoji", "Segoe UI Symbol"; font-size: 14px;"><span = style=3D"box-sizing: border-box;">Current Status:</span> The Snort = engine has successfully verified the configurations, compiled the rule = chains, and is now fully active and running on the WAN interface. No = further action is required unless a subsequent rule update overwrites = these manual patches before the vendor pushes official = fixes.</p><div><br><blockquote type=3D"cite"><div>On Jun 4, 2026, at = 06:46, Research via Snort-sigs <[email protected]> = wrote:</div><br class=3D"Apple-interchange-newline"><div><div>-----BEGIN = PGP SIGNED MESSAGE-----<br>Hash: SHA1<br><br><br>Talos Snort Subscriber = Rules Update<br><br>Synopsis:<br>This release adds and modifies rules in = several categories.<br><br>Details:<br>Talos has added and modified = multiple rules in the file-identify,<br>file-other, server-apache and = server-webapp rule sets to provide<br>coverage for emerging threats from = these technologies.<br><br><br>For a complete list of new and modified = rules please see:<br><br>https://www.snort.org/advisories<br>-----BEGIN = PGP = SIGNATURE-----<br><br>iQIcBAEBAgAGBQJqIYGYAAoJEHB/DbSAg2dxiJUP+wXWvUgWICWG= YpOFv/OcJ7RR<br>FLIKNbD6ESeD7s5BrZ4ayH2dHkgC9oAW4xMnfMeqI7SF3qup8YH09iMpQ6= 0Qxg0s<br>WXII0CAGgFufoK4YG8X0qLNPxZHig94F+y6hUx/Xert6EU/AjCeNLJTW0es0INbU= <br>OSOzuHOod3JCJQPf6Swd7wkjxJ2yQuW4zvZ5T0XloiDMWkcD+b8LtuNrRa/MeUo0<br>L8= CWFJs7JQixQ+seYMy53SLITbKp5Lsl8+LDV8jSs/+SHpB4mQigLn+Mg+yr3v7H<br>JK583APs= 81RddpRN/aeCMVuJ64dnFZ6Am05Azx3Q5U3oabHDwgA26Ma2CYo+1m7j<br>2O+buB6KA7PbiZ= daT+uAV3iaHOm/j1h+yFvEPoWBGg60vhHWu239fIKzkXEJG6ge<br>s0ZsCm0T8ysglJGoJxmX= 9RnI4WaG3en9706nTdL/iZV1/7/Jl++13MaA90ZA0FWW<br>xze4DkygTeKx6edKHXk4Locrmo= 2kkDMfbHukxIaNJafvAEkK6iOPxkWD3BNmDmLG<br>0PGrDPPR+3GPScAYi7yhofQ6xl/8xmsB= GiDW3ZdTdFQB2pZELVJm9MseGJgAQq0f<br>e3fB1cRiY4QdJTC/zpI4dhr37vp8F9kqRuT3Rg= gPTqOOLCU5HOOKVbCB8wCIDdzG<br>iwuJTeZOfFvjMPgWBCCP<br>=3DHk6+<br>-----END = PGP = SIGNATURE-----<br><br>_______________________________________________<br>S= nort-sigs mailing = list<br>[email protected]<br>https://lists.snort.org/mailman/list= info/snort-sigs<br><br>Please visit http://blog.snort.org for the latest = news about Snort!<br><br>Please follow these rules: = https://snort.org/faq/what-is-the-mailing-list-etiquette<br><br>Visit = the Snort.org to subscribe to the official Snort ruleset, make sure to = stay up to date to catch the most <a href=3D" = https://snort.org/downloads/#rule-downloads">emerging = threats</a>!<br></div></div></blockquote></div><br></body></html>= --Apple-Mail=_4B4ED935-DCE9-4F12-BB80-BC26787DD6A2-- --===============3577968588696873900== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-sigs mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>! --===============3577968588696873900==--