RE: [Snort-sigs] JPEG / GDI+ DLL exploit sig?

On Tue, 2004-09-21 at 03:57, Chas Tomlin wrote:
> I'm using these rules to spot malicious jpegs.

When I posted the question I just began looking into the issue as it
doesn't appear to be critical. Perhaps I didn't believe that these two
markers are really all there is to it :)  I excepted something more
complicated like the png issue.

I thought about the restriction to port 80 like your rules have, but I
wanted to create a rule that scans all traffic and can detect these
jpegs. Also, just checking for those four bytes seemed to invite false
positives.

My thought was checking any stream (http, ftp, smb/cifs) for "|ff fe 00
01|" and "JFIF", but I can't see to get a match with the poc.jpg image.
Perhaps the distance between those two hits is too great (around 4096
bytes). I thought Snort was able to inspect up to 65535 bytes of a
reassembled stream, or not?

Oh well, need to tinker with that later. Perhaps I just spelled JFIF
wrong :)

Cheers,
Frank

signature.asc
Description: This is a digitally signed message part