ET ACTIVEX Possible Microsoft IE Install Engine Inseng.dll Arbitrary Code Execution (2)
Sourceet/open
Fileemerging-activex.rules
CreatedJuly 30, 2010
UpdatedApril 11, 2024
Classificationattempted-user
alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Microsoft IE Install Engine Inseng.dll Arbitrary Code Execution (2)"; flow:established,to_client ; file.data; content:" ASControls.InstallEngineCtl"; fast_pattern; content:"BaseUrl"; nocase; content:"SetCifFile"; nocase; pcre:"/new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*\1[\r\n\s]*\)/smi"; reference:url,osvdb.org/10705 ; reference:cve,2004-0216 ; classtype:attempted-user; sid:2003232; rev:61; metadata:created_at 2010_07_30, confidence Medium, signature_severity Major, updated_at 2024_04_11;)
References
| url | osvdb.org/10705 |
| cve | 2004-0216 |
Metadata
created at2010_07_30
confidenceMedium
signature severityMajor
updated at2024_04_11
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!