""ET WEB_CLIENT Adobe Acrobat Util.printf Buffer Overflow Attempt""

SID: 2013152

Revision: 1

Class Type: attempted-user

Metadata: affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_07_01, cve CVE_2008_2992, deployment Perimeter, confidence High, signature_severity Major, tag Web_Client_Attacks, updated_at 2011_07_01

Reference:

• cve

• 2008-2992

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

• Value: "util.printf|28 22 25|"

Within:

PCRE: "/util.printf\x28\x22\x25[^\x2C\x29]*f\x22\x2C/i"

Special Options:

• nocase

source