Last month Microsoft patched a pretty nasty vulnerability in DirectShow. Microsoft DirectShow is an API that comes with Windows and that allows applications to display all sorts of graphics files as well as to play streaming media. The MS13-056 vulnerability was privately reported to Microsoft – it is a remote code execution vulnerability that allows an attacker to craft a malicious GIF file which will exploit the vulnerability. Since the vulnerability allows the attacker to overwrite arbitrary memory it can lead to remote code execution.
It is clear that this is a very serious vulnerability. Initially there were no public exploits however later after the patch was released a proof of concept GIF image which triggers the vulnerability has been published. Now, one of our readers, Sean, reported that his IPS started firing up alerts and detecting MS13-056. Sean captured network traffic and, luckily, the GIF files were benign so these were false positive alerts (which can be annoying too – depending on the number). We were wondering if anyone else is seeing a lot of such alerts? Any real attacks in the wild? Suspicious traffic? Let us know!
-- |
Bojan 403 Posts ISC Handler Aug 28th 2013 |
Thread locked Subscribe |
Aug 28th 2013 8 years ago |
Didn't ms say they were unaware of any built in win tools that were exploitable?
Is this in the snort vrt? |
Mallory Bobalice 28 Posts |
Quote |
Aug 28th 2013 8 years ago |
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source
Not to say 3rd party tools won't be |
Mallory Bobalice 28 Posts |
Quote |
Aug 28th 2013 8 years ago |
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source
Not to say 3rd party tools won't be |
Mallory Bobalice 28 Posts |
Quote |
Aug 28th 2013 8 years ago |
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source
Not to say 3rd party tools won't be |
Mallory Bobalice 28 Posts |
Quote |
Aug 28th 2013 8 years ago |
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source
Not to say 3rd party tools won't be Edit: o-oh too many submit clicks |
Mallory Bobalice 28 Posts |
Quote |
Aug 28th 2013 8 years ago |
HP's tipping points released signatures a few days ago which have been going nuts for every user that applied them. They haven't released a fix yet, but it's again false positives on benign gif's.
|
0x2A 2 Posts |
Quote |
Aug 29th 2013 8 years ago |
HP TippingPoint released an updated DV last night which appears to have fixed the issue.
|
Sean 4 Posts |
Quote |
Aug 29th 2013 8 years ago |
Sign Up for Free or Log In to start participating in the conversation!