At 06:21 PM 2/22/2005, Rowland, Krisa W ERDC-ITL-MS Contractor wrote:
Are there any sigs out for the new Symantec vulnerability?
I assume you mean the UPX compression exploit:
http://www.securityfocus.com/archive/1/390214
In this problem, a .exe file which has been crafted to look like it was
compressed with UPX is built in such a way to exploit bugs in older
versions symantec's virus scanning engine itself. UPX is a tool much like
pklite from the dos days. UPX compresses .exe files and adds a self
extracting stub loader to the beginning of the file that decompresses it
upon execution. In order to virus scan the UPX'ed file, older versions of
symantec will try to decompress the original executable out, then scan
that. It's a bug in the decompressor that's being exploited here, so it's
triggered by virus scanning a file.
Given that the exploit is a file, not a network attack, what would you want
to try to detect here? Email messages with UPX compressed EXE files that
exploit it? Web downloads? ftp downloads? What about other transfer
mechanisms? What about existing files on your network?
This is a pretty broad thing to try to pick up at the network layer, it's
like trying to do virus scanning in snort.
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
