|
New Snort signature for Microsoft SSL Bomb DoS
The following Snort signature may have better detection for the Microsoft SSL Bomb DoS attack than the ones previously published. This was contributed by an external organization, where the signature has been running without false positives for the duration of the day. Please report any successful detections and/or false positives. There is also an indication that attackers may be changing the published exploit code to avoid detection. The below signature is designed to alert on the root cause of the vulnerability, not a specific trait of the published exploit. alert tcp any any -> $HOME_NET 443 (msg: "SSL Bomb DoS Attempt"; \ content:"|16 03 00|"; offset:0; depth:3; content:"|01|"; distance:2; \ within:1; byte_jump:1,37,relative,align; byte_test:2,>,255,0,relative; \ flow:to_server,established; classtype:attempted-dos; \ reference:cve,CAN-2004-0120; \ reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; \ sid:999999; rev:1;) \ Functional remote LSASS exploit available in CANVAS It has been reported that the LSASS exploit developed by Immunity, Inc. ( http://www.immunitysec.com/ ) is functional against Windows 2000 SP4. The vulnerability is fixed by MS-04-011. There was a posting to the "Full Disclosure" mailing list with the claim of a different exploit, but this was false. Local Exploit Released for Windows 2000 Utility Manager Vulnerability A functional local exploit has been released for CAN-2003-0908. This vulnerability was released on April 13, 2004. The vulnerability is patched with MS-04-011 (835732). The exploit was successful against Windows 2000 SP4. No log entries were found in the system logs. At this time, it appears the exploit is NOT successful against Terminal Server logins because the utility manager program cannot be run remotely. If you have additional information about this vulnerability or exploit, please send it to handlers@sans.org. http://www.k-otik.com/exploits/04152004.UtilManExploit.c.php Port 905 Increase There has been a small surge of scanning for port 905. It appears to be an attempt to find the Netdevil.B backdoor/trojan that listens on this port. If you have packet captures of this activity, please submit them. http://isc.sans.org/port_details.php?port=905 http://securityresponse.symantec.com/avcenter/venc/data/backdoor.netdevil.b.html http://securityresponse.symantec.com/avcenter/venc/data/backdoor.netdevil.html |
Handlers 76 Posts Apr 17th 2004 |
| Thread locked Subscribe |
Apr 17th 2004 1 decade ago |
Sign Up for Free or Log In to start participating in the conversation!
