HTTP: Adobe Acrobat Reader CVE-2013-5065 Malicious Dropper

This signature detects the pdf dropper that is being used in-the-wild to exploit a known privilege escalation vulnerability against Windows XP and Windows Server 2003. Successful exploitation could lead to arbitrary code execution in Kernel mode.

Extended Description

NDProxy.sys in the kernel in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in November 2013.

Affected Products

Microsoft windows_2003_server

References

CVE: CVE-2013-5065

URL: http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html

Short Name

HTTP:STC:ADOBE:2013-5065-PDF

Severity

Critical

Recommended

False

Recommended Action

Drop

HTTP: Adobe Acrobat Reader CVE-2013-5065 Malicious Dropper

Extended Description

Affected Products

References

Found a potential security threat?