""ET WEB_CLIENT QuickTime Remote Exploit (exploit specific)""

SID: 2012806

Revision: 2

Class Type: attempted-user

Metadata: affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_05_14, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2011_05_14

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "|2f 2f|mshtml|2e|dll"

  • Value: "unescape|28|"

  • Value: "onload"

  • Value: "ObjectLoad|28|"

Within: 32

PCRE: "/src\s\x3d\s\x22res\x3a\x2f\x2fmshtml\x2edll/"

Special Options:

  • file_data

  • nocase

  • nocase

  • nocase

source