Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: MS13-056 (false positive)? alerts - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
MS13-056 (false positive)? alerts

Last month Microsoft patched a pretty nasty vulnerability in DirectShow. Microsoft DirectShow is an API that comes with Windows and that allows applications to display all sorts of graphics files as well as to play streaming media.

The MS13-056 vulnerability was privately reported to Microsoft – it is a remote code execution vulnerability that allows an attacker to craft a malicious GIF file which will exploit the vulnerability. Since the vulnerability allows the attacker to overwrite arbitrary memory it can lead to remote code execution.

It is clear that this is a very serious vulnerability. Initially there were no public exploits however later after the patch was released a proof of concept GIF image which triggers the vulnerability has been published.
All Windows versions are affected (Windows XP/Vista/7/8) so make sure that you have patched your systems against it if you haven't already – the vulnerability can be theoretically easily turned into a drive by exploit.

Now, one of our readers, Sean, reported that his IPS started firing up alerts and detecting MS13-056. Sean captured network traffic and, luckily, the GIF files were benign so these were false positive alerts (which can be annoying too – depending on the number).

We were wondering if anyone else is seeing a lot of such alerts? Any real attacks in the wild? Suspicious traffic? Let us know!

--
Bojan
@bojanz

INFIGO IS

I will be teaching next: Web App Penetration Testing and Ethical Hacking - Cloud Security Summit & Training 2019

Bojan

376 Posts
ISC Handler
Didn't ms say they were unaware of any built in win tools that were exploitable?

Is this in the snort vrt?
Mallory Bobalice

28 Posts
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source

Not to say 3rd party tools won't be
Mallory Bobalice

28 Posts
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source

Not to say 3rd party tools won't be
Mallory Bobalice

28 Posts
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source

Not to say 3rd party tools won't be
Mallory Bobalice

28 Posts
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source

Not to say 3rd party tools won't be

Edit: o-oh too many submit clicks
Mallory Bobalice

28 Posts
HP's tipping points released signatures a few days ago which have been going nuts for every user that applied them. They haven't released a fix yet, but it's again false positives on benign gif's.
0x2A

2 Posts
HP TippingPoint released an updated DV last night which appears to have fixed the issue.
Sean

4 Posts

Sign Up for Free or Log In to start participating in the conversation!