[Snort-sigs] Microsoft IFrame vulnerability

Chris Mills securinate at ...2420...
Thu Dec 2 06:15:10 EST 2004


Thanks for the quick response. I'll apply these sigs and try to tweak
out some of my own. I'll post back the ones that work.

Chris


On Thu, 02 Dec 2004 09:01:13 -0500, Matt Jonkman <matt at ...2436...> wrote:
> I made an attempt at it, there's a rule up here:
> http://www.bleedingsnort.com/cgi-bin/viewcvs.cgi/Stable/EXPLOIT_IE_Vulnerabilities?rev=1.23&content-type=text/vnd.viewcvs-markup
> 
> alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE
> EXPLOIT IE IFRAME Exploit";
> pcre:"/(EMBED|FRAME|SRC)\s*=\s*["']*?(file|http)\://\w{578}|/W{578}/im";
> pcre:"/(EMBED|FRAME|SRC|NAME)\s*=\s*["']\w{2086}|\W{2086}/im";
> content:"\/IFRAME"; nocase; flow:from_server,established; sid:2001401;
> rev:9;)
> 
> The one detected the exploit that was originally released, but the
> variations have been significant.
> 
> The paper you noted we helped feed data to from other bleeding snort
> sigs. The authors there did a lot of great work which let us put up
> about 80 new spyware sigs from that investigation. About all we learned
> about the iframe vuln through that was that the sigs we had weren't
> working. There were versions that were encoded, versions with just small
> portions encoded, and versions being delivered in zip files to be opened
> locally, etc. It seemed rather useless to try to work on that sig more
> while we were finding that many new spyware packages to detect.
> 
> Interestingly, this sig from Joseph detects the original exploit as
> well. It had no better luck with getting any variants either though.
> 
> alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE
> IFRAME ExecCommand vulnerability"; content:"<IFRAME"; nocase;
> pcre:"/SRC[\s]*=[\s]*["']*[\x09\x0a\x0b\x0c\x0d]*f[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*e[\x09\x0a\x0b\x0c\x0d]*\:/Ri";
> reference:url,www.securiteam.com/exploits/3D5Q4RFPPK.html;
> classtype:misc-activity; flow:from_server,established; sid:2001095; rev:2;)
> 
> Brian had mentioned privately he was working on a sig for release, but I
> haven't noticed it yet. You still have something in the works Brian?
> 
> Matt
> 
> 
> 
> Chris Mills wrote:
> > Hi all-
> > Yesterday, microsoft released the patch for the IFrame exploit, but
> > I'm looking for a good signature to detect it still. Given the
> > randomness of the way they are doing this exploit, it seems the only
> > common string in these http documents to look for is "iframe." Please
> > lend some advice for signatures for this that will reduce false
> > positives. A good source of info on this is at
> > http://www.vitalsecurity.org/xpire-splitinfinity-serverhack_malwareinstall-condensed.pdf
> >
> > Thanks,
> > Chris
> >
> > 
> > -------------------------------------------------------
> > SF email is sponsored by - The IT Product Guide
> > Read honest & candid reviews on hundreds of IT Products from real users.
> > Discover which products truly live up to the hype. Start reading now.
> > http://productguide.itmanagersjournal.com/
> > _______________________________________________
> > Snort-sigs mailing list
> > Snort-sigs at lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/snort-sigs
> 
> --
> --------------------------------------------
> Matthew Jonkman, CISSP
> Senior Security Engineer
> Infotex
> 765-429-0398 Direct Anytime
> 765-448-6847 Office
> 866-679-5177 24x7 NOC
> my.infotex.com
> www.offsitefilter.com
> --------------------------------------------
> 
> NOTICE: The information contained in this email is confidential
> and intended solely for the intended recipient. Any use,
> distribution, transmittal or retransmittal of information
> contained in this email by persons who are not intended
> recipients may be a violation of law and is strictly prohibited.
> If you are not the intended recipient, please contact the sender
> and delete all copies.
>




More information about the Snort-sigs mailing list