ET WEB_CLIENT Possible Javascript obfuscation using app.setTimeOut in PDF in Order to Run Code

7.0.35.0SID: 2011868Rev: 6Enabled1 views
Sourceet/open
Fileemerging-web_client.rules
CreatedOctober 29, 2010
UpdatedApril 9, 2024
Classificationbad-unknown
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Javascript obfuscation using app.setTimeOut in PDF in Order to Run Code"; flow:established,to_client; file.data; content:"PDF-"; depth:300; content:"app.setTimeOut("; fast_pattern; nocase; distance:0; reference:url,www.h-online.com/security/features/CSI-Internet-PDF-timebomb-1038864.html?page=4; reference:url,www.vicheck.ca/md5query.php?hash=6932d141916cd95e3acaa3952c7596e4; reference:cve,2018-4980; reference:cve,2018-4961; classtype:bad-unknown; sid:2011868; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_10_29, cve CVE_2018_4980, deployment Perimeter, confidence Medium, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_04_09;)

References

urlwww.h-online.com/security/features/CSI-Internet-PDF-timebomb-1038864.html?page=4
urlwww.vicheck.ca/md5query.php?hash=6932d141916cd95e3acaa3952c7596e4
cve2018-4980
cve2018-4961

Metadata

affected productWeb_Browser_Plugins
attack targetClient_Endpoint
created at2010_10_29
deploymentPerimeter
confidenceMedium
signature severityMajor
tagWeb_Client_Attacks
updated at2024_04_09

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!