HTTP: Malicious .MDB File Access through HTTP
This signature detects malicious .MDB files transmitted through HTTP. Attackers can craft a malicious MDB database and provide a HTTP link to a target system; when the user opens the link, the database is opened by the default handler (typically the MS-Jet DLL), which might enable the attacker to execute code.
Extended Description
Microsoft Jet Database Engine is vulnerable to a buffer-overflow vulnerability because the library fails to properly bounds-check the contents of user-supplied database files. Attackers may exploit this vulnerability to execute arbitrary machine code in the context of the victim trying to access a malicious Jet database file. This vulnerability is reported to reside in the 'msjet40.dll' library, version 4.00.8618.0. Older versions may also be affected. The 'msjetole40.dll' OLE (Object Linking and Embedding) library is reportedly immune to this vulnerability. The Backdoor.Hesive trojan is reported to employ this vulnerability to install itself on vulnerable computers. Please see the web reference for more information.
Affected Products
Microsoft access_2002
Short Name
HTTP:STC:DL:MAL-MDB
Severity
Critical
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
.MDB Access CVE-2005-0944 CVE-2007-6026 CVE-2008-1092 File HTTP Malicious bid:12960 bid:26468 through
Release Date
04/12/2005
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3724
False Positive
Unknown
Vendors
Microsoft
CVSS Score
7.5
9.3