[prev in list] [next in list] [prev in thread] [next in thread]
List: snort-sigs
Subject: [Snort-sigs] Possible 17154 FP?
From: "Lay, James" <james.lay () wincofoods ! com>
Date: 2010-10-22 20:08:19
Message-ID: 9CD7E26FAC8E2D4F9778A1609AE132CF21EEC2 () goexchange ! go ! winco ! local
[Download RAW message or body]
Rule:
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT
Mozilla Firefox plugin parameter array dangling pointer exploit attempt
- 2"; flow:to_client,established; content:"<object"; nocase;
content:"|27 27|"; within:200; fast_pattern;
pcre:"/\x3Cobject(?![^\x3E]+?src)[^\x3E]+?data\s*\x3D\s*\x27\x27/i";
metadata:service http; reference:bugtraq,41933; reference:cve,2010-2755;
classtype:attempted-user; sid:17154; rev:1;)
Rule hit:
10/22-13:52:19.555107 [**] [1:17154:1] WEB-CLIENT Mozilla Firefox
plugin parameter array dangling pointer exploit attempt - 2 [**]
[Classification: Attempted User Privilege Gain] [Priority: 1] {TCP}
68.142.250.142:80 -> 66.193.105.132:54117
Packet dump
13:52:19.566108 IP 68.142.250.142.80 > 66.193.105.132.54117: Flags [.],
ack 1, win 9648, length 1400
0x0000: 4500 05a0 c439 4000 3b06 8abc 448e fa8e
E....9@.;...D...
0x0010: 42c1 6984 0050 d365 dd6d 30fd 6b30 49a8
B.i..P.e.m0.k0I.
0x0020: 5010 25b0 5752 0000 6f70 7065 643a 307d
P.%.WR..opped:0}
0x0030: 3b59 4148 4f4f 2e6d 6564 6961 706c 6179
;YAHOO.mediaplay
0x0040: 6572 2e51 5445 6e67 696e 652e 7072 6f74
er.QTEngine.prot
0x0050: 6f74 7970 652e 696e 6974 3d66 756e 6374
otype.init=funct
0x0060: 696f 6e28 297b 7472 790a 7b76 6172 2070
ion(){try.{var.p
0x0070: 6c75 6769 6e49 6e73 7461 6c6c 6564 3d66
luginInstalled=f
0x0080: 616c 7365 3b69 6628 5941 484f 4f2e 6d65
alse;if(YAHOO.me
0x0090: 6469 6170 6c61 7965 722e 5574 696c 2e64
diaplayer.Util.d
0x00a0: 6574 6563 7450 6c75 6769 6e28 2251 7569
etectPlugin("Qui
0x00b0: 636b 5469 6d65 2050 6c75 672d 696e 222c
ckTime.Plug-in",
0x00c0: 2251 7569 636b 5469 6d65 2e51 7569 636b
"QuickTime.Quick
0x00d0: 5469 6d65 2229 213d 3d6e 756c 6c29 7b70
Time")!==null){p
0x00e0: 6c75 6769 6e49 6e73 7461 6c6c 6564 3d74
luginInstalled=t
0x00f0: 7275 653b 7d69 6628 706c 7567 696e 496e
rue;}if(pluginIn
0x0100: 7374 616c 6c65 643d 3d3d 7472 7565 297b
stalled===true){
0x0110: 7661 7220 6475 6d6d 7943 6f6e 7461 696e
var.dummyContain
0x0120: 6572 3d64 6f63 756d 656e 742e 6372 6561
er=document.crea
0x0130: 7465 456c 656d 656e 7428 2773 7061 6e27
teElement('span'
0x0140: 293b 6475 6d6d 7943 6f6e 7461 696e 6572
);dummyContainer
0x0150: 2e69 643d 2264 756d 6d79 2d71 7465 6e67
.id="dummy-qteng
0x0160: 696e 6522 3b64 6f63 756d 656e 742e 626f
ine";document.bo
0x0170: 6479 2e61 7070 656e 6443 6869 6c64 2864
dy.appendChild(d
0x0180: 756d 6d79 436f 6e74 6169 6e65 7229 3b76
ummyContainer);v
0x0190: 6172 2068 746d 6c3d 2222 3b69 6628 5941
ar.html="";if(YA
0x01a0: 484f 4f2e 6d65 6469 6170 6c61 7965 722e
HOO.mediaplayer.
0x01b0: 5574 696c 2e42 524f 5753 4552 3d3d 3d22
Util.BROWSER==="
0x01c0: 4d53 4945 2229 7b68 746d 6c2b 3d27 3c6f
MSIE"){html+='<o
0x01d0: 626a 6563 7420 6964 3d22 7174 5f65 7665
bject.id="qt_eve
0x01e0: 6e74 5f73 6f75 7263 6522 2063 6c61 7373
nt_source".class
0x01f0: 6964 3d22 636c 7369 643a 4342 3932 3744
id="clsid:CB927D
0x0200: 3132 2d34 4646 372d 3461 3965 2d41 3136
12-4FF7-4a9e-A16
0x0210: 392d 3536 4534 4238 4137 3535 3938 2227
9-56E4B8A75598"'
0x0220: 2b27 2063 6f64 6562 6173 653d 2268 7474
+'.codebase="htt
0x0230: 703a 2f2f 7777 772e 6170 706c 652e 636f
p://www.apple.co
0x0240: 6d2f 7174 6163 7469 7665 782f 7174 706c
m/qtactivex/qtpl
0x0250: 7567 696e 2e63 6162 2376 6572 7369 6f6e
ugin.cab#version
0x0260: 3d37 2c32 2c31 2c30 2220 3e3c 2f6f 626a
=7,2,1,0".></obj
0x0270: 6563 743e 272b 273c 6f62 6a65 6374 2063
ect>'+'<object.c
0x0280: 6c61 7373 6964 3d22 636c 7369 643a 3032
lassid="clsid:02
0x0290: 4246 3235 4435 2d38 4331 372d 3442 3233
BF25D5-8C17-4B23
0x02a0: 2d42 4338 302d 4433 3438 3841 4244 4443
-BC80-D3488ABDDC
0x02b0: 3642 2227 2b27 2063 6f64 6562 6173 653d
6B"'+'.codebase=
0x02c0: 2268 7474 703a 2f2f 7777 772e 6170 706c
"http://www.appl
0x02d0: 652e 636f 6d2f 7174 6163 7469 7665 782f
e.com/qtactivex/
0x02e0: 7174 706c 7567 696e 2e63 6162 2376 6572
qtplugin.cab#ver
0x02f0: 7369 6f6e 3d37 2c32 2c31 2c30 2227 2b27
sion=7,2,1,0"'+'
0x0300: 2077 6964 7468 3d22 3022 2068 6569 6768
.width="0".heigh
0x0310: 743d 2230 2220 7479 7065 3d22 6175 6469
t="0".type="audi
0x0320: 6f2f 7175 6963 6b74 696d 6522 2069 643d
o/quicktime".id=
0x0330: 2227 2b74 6869 732e 6964 2b27 2227 2b27
"'+this.id+'"'+'
0x0340: 2063 6f6e 7472 6f6c 6c65 723d 2266 616c
.controller="fal
0x0350: 7365 2220 7374 796c 653d 2262 6568 6176
se".style="behav
0x0360: 696f 723a 7572 6c28 2371 745f 6576 656e
ior:url(#qt_even
0x0370: 745f 736f 7572 6365 293b 223e 272b 273c
t_source);">'+'<
0x0380: 7061 7261 6d20 6e61 6d65 3d22 636f 6e74
param.name="cont
0x0390: 726f 6c6c 6572 2220 7661 6c75 653d 2266
roller".value="f
0x03a0: 616c 7365 222f 3e3c 7061 7261 6d20 6e61
alse"/><param.na
0x03b0: 6d65 3d22 7372 6322 2076 616c 7565 3d22
me="src".value="
0x03c0: 222f 3e3c 7061 7261 6d20 6e61 6d65 3d22
"/><param.name="
0x03d0: 706f 7374 646f 6d65 7665 6e74 7322 2076
postdomevents".v
0x03e0: 616c 7565 3d22 7472 7565 222f 3e27 2b27
alue="true"/>'+'
0x03f0: 3c2f 6f62 6a65 6374 3e27 3b7d 656c 7365
</object>';}else
0x0400: 0a7b 6874 6d6c 2b3d 223c 656d 6265 6420
.{html+="<embed.
0x0410: 7769 6474 683d 2731 7078 2720 6865 6967
width='1px'.heig
0x0420: 6874 3d27 3170 7827 2022 2b22 6964 3d27
ht='1px'."+"id='
0x0430: 222b 7468 6973 2e69 642b 2227 2022 2b22
"+this.id+"'."+"
0x0440: 6e61 6d65 3d27 222b 7468 6973 2e69 642b
name='"+this.id+
0x0450: 2227 2022 2b22 7479 7065 3d27 7669 6465
"'."+"type='vide
0x0460: 6f2f 7175 6963 6b74 696d 6527 2022 2b22
o/quicktime'."+"
0x0470: 7372 633d 2727 2022 2b22 706c 7567 696e
src=''."+"plugin
0x0480: 7370 6167 653d 2768 7474 703a 2f2f 7777
spage='http://ww
0x0490: 772e 6170 706c 652e 636f 6d2f 7175 6963
w.apple.com/quic
0x04a0: 6b74 696d 652f 646f 776e 6c6f 6164 2f27
ktime/download/'
0x04b0: 2022 2b22 656e 6162 6c65 6a61 7661 7363
."+"enablejavasc
0x04c0: 7269 7074 3d27 7472 7565 2720 222b 2263
ript='true'."+"c
0x04d0: 6f6e 7472 6f6c 6c65 723d 2766 616c 7365
ontroller='false
0x04e0: 2720 222b 2273 7479 6c65 3d27 706f 7369
'."+"style='posi
0x04f0: 7469 6f6e 3a66 6978 6564 3b20 746f 703a
tion:fixed;.top:
0x0500: 303b 2072 6967 6874 3a30 3b27 2022 2b22
0;.right:0;'."+"
0x0510: 6175 746f 706c 6179 3d27 7472 7565 2720
autoplay='true'.
0x0520: 706f 7374 646f 6d65 7665 6e74 733d 2774
postdomevents='t
0x0530: 7275 6527 222b 222f 3e22 3b7d 6475 6d6d
rue'"+"/>";}dumm
0x0540: 7943 6f6e 7461 696e 6572 2e69 6e6e 6572
yContainer.inner
0x0550: 4854 4d4c 3d68 746d 6c3b 7468 6973 2e74
HTML=html;this.t
0x0560: 696d 654f 7574 3d77 696e 646f 772e 7365
imeOut=window.se
0x0570: 7454 696d 656f 7574 2827 5941 484f 4f2e
tTimeout('YAHOO.
0x0580: 6d65 6469 6170 6c61 7965 722e 436f 6e74
mediaplayer.Cont
0x0590: 726f 6c6c 6572 2e71 7465 6e67 696e 652e
roller.qtengine.
James Lay
IT Security Analyst
WinCo Foods
208-672-2014 Office
208-559-1855 Cell
650 N Armstrong Pl.
Boise, Idaho 83704
------------------------------------------------------------------------------
Nokia and AT&T present the 2010 Calling All Innovators-North America contest
Create new apps & games for the Nokia N8 for consumers in U.S. and Canada
$10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store
http://p.sf.net/sfu/nokia-dev2dev
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic