Sourcefire and iDEFENSE First to Deliver Detection for New Microsoft Vulnerabilities; Snort and Sourcefire Users Protected at Time of Vulnerability Announcement.

COLUMBIA, Md. & RESTON, Va. -- Sourcefire, Inc., the world leader in real-time network defense, and iDEFENSE, the global leader in cyber threat intelligence solutions, today announced that their customers are the first who can detect the new Microsoft Internet Explorer and Windows operating system vulnerabilities announced earlier today. Through collaboration with iDEFENSE, the Sourcefire Vulnerability Research Team (VRT) received notice of these serious and remotely exploitable vulnerabilities.

Sourcefire and iDEFENSE customers received new rules for the Sourcefire 3D System in conjunction with Microsoft's public notification of the vulnerabilities, allowing them to immediately protect their networks and preempt possible exploits. In addition, new VRT Certified Rules were made available to Snort subscribers.

iDEFENSE has issued public advisories detailing the vulnerabilities. The cooperation between the two companies provided a fully integrated technology and intelligence solution that prevents hackers from compromising a customer's network.

"Understanding that threats continue to emerge, iDEFENSE is pleased to continue collaborating with vendors like Sourcefire, combining intelligence and technology, to provide our customers and the Snort community with the best possible defense" said Michael Sutton, director of iDEFENSE's vulnerability research. "We continue to turn to Sourcefire because of its reputation for and the ability of its Vulnerability Research Team to create superior Snort rules in real time."

"Sourcefire is proud to team with leading threat intelligence companies like iDEFENSE to ensure that Sourcefire customers and Snort users have coverage in advance of actual threats," said Martin Roesch, Sourcefire CTO and creator of Snort. "The combination of iDEFENSE with Sourcefire's Vulnerability Research Team not only provides users with immediate notification of vulnerabilities but real-time delivery of the world's leading detection and prevention rules."

Vulnerability Details

A flaw in the Microsoft Internet Explorer DHTML Engine may allow an attacker to exploit a race condition and possibly execute code of their choosing on the victim host with the privileges of the user running Internet Explorer. In addition, a programming error in Microsoft Internet Explorer may allow an attacker to execute code of their choosing on a vulnerable host. Finally, Microsoft Windows has design errors that may enable an attacker to execute code of their choosing on a vulnerable system. Specifically, it is possible to execute code from seemingly non-executable objects. On average, iDEFENSE customers were informed of these vulnerabilities 145 days in advance of the public disclosure.

Further information about these vulnerabilities and how to obtain Sourcefire or Snort Rules are available at http://www.sourcefire.com/services/advisories/sa041205.html or http://www.snort.org/rules/.

iDEFENSE's detailed advisories on the Microsoft vulnerabilities can be found online at:

--Microsoft Internet Explorer DHTML Engine Race Condition - http://www.idefense.com/application/poi/display?id=228&type= vulnerabilities (Due to its length, this URL may need to be copied/pasted into your Internet browser's address field. Remove the extra space if one exists.)

--Microsoft Windows Internet Explorer Long Hostname Heap Corruption Vulnerability - http://www.idefense.com/application/poi/display?id=229&type= vulnerabilities (Due to its length, this URL may need to be copied/pasted into your Internet browser's address field. Remove the extra space if one exists.)

--Microsoft MSHTA Script Execution Vulnerability - http://www.idefense.com/application/poi/display?id=231&type= vulnerabilities (Due to its length, this URL may need to be copied/pasted into your Internet browser's address field. Remove the extra space if one exists.)

About the Sourcefire Vulnerability Research Team

The Sourcefire VRT is comprised of leading edge intrusion detection experts working to proactively discover, assess and respond to the latest trends in hacking activity, intrusion attempts and vulnerabilities. This team is also supported by the vast resources of the open source Snort community, making it the largest group dedicated to advances in network security.

About Sourcefire's 3D System

Sourcefire's 3D Approach - Discover, Determine, Defend - to securing real networks in real-time provides proactive defense-in-depth through an integrated process of discovering risks, vulnerabilities and threats; determining their business impact; and taking the appropriate action to defend the network. Sourcefire's 3D System, including Sourcefire Intrusion Sensors and Agents, Sourcefire RNA Sensors and the Sourcefire Defense Center, provides companies with the most effective security possible.

The Sourcefire 3D System offers the most flexible and precise intrusion detection and network discovery technologies worldwide. Sourcefire Intrusion Sensors utilize the award-winning Snort rules-based detection engine, bringing the benefits of signature, protocol, and anomaly-based inspection methods to all varying network traffic speeds. In addition, Sourcefire RNA Sensors passively monitor a network to deliver highly detailed, real-time profiles of all network assets including their configuration, behavior, potential vulnerabilities and associated changes. By tightly integrating and correlating the threat information provided by Sourcefire Intrusion Sensors and Agents with the network intelligence provided by Sourcefire RNA Sensors, the Sourcefire Defense Center easily prioritizes the millions of security events to determine the most critical events to an organization's business and takes the appropriate actions. These actions follow the ABCs of Defense - Alert, Block, Correct - all in real-time to deliver the most effective security.

About iDEFENSE

iDEFENSE, based in Reston, Va., provides information security intelligence to the U.S. government and Global 2000 companies, including leaders in financial services, energy, transportation and telecommunications. The company provides customized, actionable, timely and relevant intelligence detailing potential threats, vulnerabilities and security issues directly to C-level executives, general counsels, auditors, senior security managers and staff, and system administrators. Further information is available at www.idefense.com or [phone].

About Sourcefire

Sourcefire, Inc., the world leader in real-time network defense solutions, is transforming the way organizations manage and minimize network security risks with its 3D Approach - Discover, Determine, Defend - to securing real networks in real-time. The company's ground-breaking network defense system unifies intrusion and vulnerability management technologies to provide customers with the most effective network security available. Founded in 2001 by the creator of Snort, Sourcefire is headquartered in Columbia, MD and has received numerous accolades including being named a 2004 Company to Watch by Network Computing Magazine and selected as one of the Red Herring Top 100 privately held companies. At work in leading Fortune 1000 and government agencies, the names Sourcefire and founder Martin Roesch have grown synonymous with innovation and intelligence in network security. For more information about Sourcefire, please visit www.sourcefire.com.