Bugtraq mailing list archives
RE: [Full-disclosure] 0-day ANI vulnerability in Microsoft Windows(CVE-2007-0038)
From: "Eric Sites" <erics () sunbelt-software com>
Date: Fri, 30 Mar 2007 20:47:42 -0400
You really need to check for: RIFF[4 byte file size] <-- The file size can be ignored. Then the next 4 byte after the file size should contain: ACON Then look for: anih and the 4 byte value following it greater than 0x50, this is the stack buffer overflow point. New ANIs can be built with any number of anih chunks and only one of them needs to be larger than 80 bytes decimal. Cheers, Eric Sites, CTO Sunbelt Software -----Original Message----- From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Alexander Sotirov Sent: Friday, March 30, 2007 8:29 PM To: Jan Wrobel Cc: full-disclosure () lists grok org uk; bugtraq () securityfocus com Subject: Re: [Full-disclosure] 0-day ANI vulnerability in Microsoft Windows(CVE-2007-0038) Jan Wrobel wrote:
I don't know if this rule detects all possible exploits or just one particular type. Here is a Firekeeper version of the rule, which can be used to detect sites hosting malicious files: alert (msg:"BLEEDING-EDGE CURRENT EVENTS MS ANI exploit";
body_content:"|54 53 49 4C 03 00 00 00 00 00 00 00 54 53 49 4C 04 00 00 00 02 02 02 02 61 6E 69 68 52|"; reference:url,http://isc.sans.org/diary.html?storyid=2534; reference:url,http://www.avertlabs.com/research/blog/?p=233; reference:url,doc.bleedingthreats.net/2003519; fid:2003519; rev:1;) A better way would be to look for all files that start with "RIFF" and contain two copies of the string "anih", the first one followed by the dword 0x24, the second one followed by a dword that's not 0x24. This should detect the exploitation of the stack overflow with no false negatives. To avoid false positives, you'll need code to parse all records in the ANI file and check for more an "anih" record with a size not equal to 0x24. Here's the regexp in Perl (somebody please convert it to a Snort rule) /^RIFF.*anih\x24\x00\x00\x00.*anih(?!\x24\x00\x00\x00)/ Alex ..
Current thread:
- 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038) Alexander Sotirov (Mar 30)
- Re: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038) Jan Wrobel (Mar 31)
- Re: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038) Alexander Sotirov (Mar 31)
- RE: [Full-disclosure] 0-day ANI vulnerability in Microsoft Windows(CVE-2007-0038) Eric Sites (Mar 31)
- Re: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038) Alexander Sotirov (Mar 31)
- Re: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038) Alexander Sotirov (Mar 31)
- Re: 0-day ANI vulnerability in Microsoft Windows (CVE-2007-0038) Jan Wrobel (Mar 31)