RE: [Snort-sigs] New adobe vulnerability

From: "Matthew Jonkman" <matt@infotex.com>
> Just put this rule up on the bleedingsnort.com set for the new adobe 
> exploit detailed here:
> http://idefense.com/application/poi/display?id=126&type=vulnerabilities
>
> The rule:
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE 
> Adobe Acrobat Reader Malicious URL Null Byte"; 
> reference:url,idefense.com/application/poi/display?id=126&type=vulnerabilities;
>  
> uricontent:".pdf%00"; classtype:web-attack; sid:2002001; rev:1;)
>
> I'm posting this because this just seems far too simple. I have to be 
> missing something. This look right to everyone?
>
> Matt

You have not considered the impact of http_inspect. Therefore you need 
to look for "real" ASCII zero, not its encoding and do not forget 
to toss in nocase and flow:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Adobe Acrobat Reader Malicious URL Null Byte"; 
flow:to_server,established; uricontent:".pdf|00|"; nocase;
reference:cve,2004-0629; classtype:web-attack; sid:2002001; rev:???;)


Cheers,
nnposter


-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs