Brian and I are talking off list. Jamie is right, it's to catch the
iframe exploit. It does cath it. Brian had some very good optimization
tips, I'll get those posted shortly.
Matt
James Riden wrote:
Brian <bmc@snort.org> writes:
On Wed, Nov 03, 2004 at 12:13:00AM -0600, matt@infotex.com wrote:
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (
msg:"BLEEDING-EDGE EXPLOIT IE Iframe Exploit";
flow:established,from_server; content:"<IFRAME "; nocase;
content:"SRC=file"; nocase; offset:500; content:"NAME=";
offset:1000; content:"<\/IFRAME>"; nocase; sid:2001401; rev:1;)
Ok, I'm stumped. What is this rule supposed to do?
Brian
There was a PoC posted to Bugtraq recently - I assume this is what
it's meant to pick up. As to whether it does it or not, you're the
expert there :)
cheers,
Jamie
== quote ==
From: Michal Zalewski <lcamtuf@coredump.cx>
Subject: MSIE <IFRAME> and <FRAME> tag NAME property bufferoverflow PoC exploit
(was: python does mangleme (with IE bugs!)) (fwd)
To: bugtraq@securityfocus.com
Date: Tue, 2 Nov 2004 10:19:34 +0100 (CET)
A supposed PoC for a vulnerability discovered by ned of felinemenace.org
over a week ago, using his Python port of my mangleme utility (the utility
itself released some two weeks ago).
I'm taking this opportunity to do some whoring because the author
indicated that his original post bounced off BUGTRAQ due to "illegal"
Content-Type of text/html.
/mz
--
--------------------------------------------
Matthew Jonkman, CISSP
Senior Security Engineer
Infotex
765-429-0398 Direct Anytime
765-448-6847 Office
866-679-5177 24x7 NOC
my.infotex.com
www.offsitefilter.com
--------------------------------------------
NOTICE: The information contained in this email is confidential
and intended solely for the intended recipient. Any use,
distribution, transmittal or retransmittal of information
contained in this email by persons who are not intended
recipients may be a violation of law and is strictly prohibited.
If you are not the intended recipient, please contact the sender
and delete all copies.
-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
