[Snort-sigs] Microsoft IFrame vulnerability

Matt Jonkman matt at ...2436...
Thu Dec 2 06:02:02 EST 2004


I made an attempt at it, there's a rule up here:
http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/Stable/EXPLOIT_IE_Vulnerabilities?rev=1.23&content-type=text/vnd.viewcvs-markup


alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE 
EXPLOIT IE IFRAME Exploit"; 
pcre:"/(EMBED|FRAME|SRC)\s*=\s*["']*?(file|http)\://\w{578}|/W{578}/im"; 
pcre:"/(EMBED|FRAME|SRC|NAME)\s*=\s*["']\w{2086}|\W{2086}/im"; 
content:"\/IFRAME"; nocase; flow:from_server,established; sid:2001401; 
rev:9;)

The one detected the exploit that was originally released, but the 
variations have been significant.

The paper you noted we helped feed data to from other bleeding snort 
sigs. The authors there did a lot of great work which let us put up 
about 80 new spyware sigs from that investigation. About all we learned 
about the iframe vuln through that was that the sigs we had weren't 
working. There were versions that were encoded, versions with just small 
portions encoded, and versions being delivered in zip files to be opened 
locally, etc. It seemed rather useless to try to work on that sig more 
while we were finding that many new spyware packages to detect.

Interestingly, this sig from Joseph detects the original exploit as 
well. It had no better luck with getting any variants either though.

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE 
IFRAME ExecCommand vulnerability"; content:"<IFRAME"; nocase; 
pcre:"/SRC[\s]*=[\s]*["']*[\x09\x0a\x0b\x0c\x0d]*f[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*e[\x09\x0a\x0b\x0c\x0d]*\:/Ri"; 
reference:url,www.securiteam.com/exploits/3D5Q4RFPPK.html; 
classtype:misc-activity; flow:from_server,established; sid:2001095; rev:2;)

Brian had mentioned privately he was working on a sig for release, but I 
haven't noticed it yet. You still have something in the works Brian?

Matt

Chris Mills wrote:
> Hi all-
> Yesterday, microsoft released the patch for the IFrame exploit, but
> I'm looking for a good signature to detect it still. Given the
> randomness of the way they are doing this exploit, it seems the only
> common string in these http documents to look for is "iframe." Please
> lend some advice for signatures for this that will reduce false
> positives. A good source of info on this is at
> http://www.vitalsecurity.org/xpire-splitinfinity-serverhack_malwareinstall-condensed.pdf
> 
> Thanks,
> Chris
> 
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now. 
> http://productguide.itmanagersjournal.com/
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs

-- 
--------------------------------------------
Matthew Jonkman, CISSP
Senior Security Engineer
Infotex
765-429-0398 Direct Anytime
765-448-6847 Office
866-679-5177 24x7 NOC
my.infotex.com
www.offsitefilter.com
--------------------------------------------


NOTICE: The information contained in this email is confidential
and intended solely for the intended recipient. Any use,
distribution, transmittal or retransmittal of information
contained in this email by persons who are not intended
recipients may be a violation of law and is strictly prohibited.
If you are not the intended recipient, please contact the sender
and delete all copies.




More information about the Snort-sigs mailing list