SHELLCODE: x86 Intel Architecture Instruction Set NOOP Slide (TCP-CTS)

This signature detects attempts to exploit a known vulnerability against an x86 system. Attackers can send long strings of NOOPs to overflow the buffer and gain root access. To properly use this signature in your policy, override the default service binding to the services you wish to protect.

Extended Description

The libc library includes functions which perform DNS lookups. A buffer overflow vulnerability has been reported in versions of libc used by some operating systems. In particular, FreeBSD, NetBSD, OpenBSD and GNU glibc have been reported to suffer from this issue. The vulnerable code is related to DNS queries. It may be possible for a malicious DNS server to provide a response which will exploit this vulnerability, resulting in the execution of arbitrary code as the vulnerable process. The consequences of exploitation will be highly dependant on the details of individual applications using libc.

Affected Products

Hp colour_laserjet_4550,Gnu glibc

References

BugTraq: 5100

CVE: CVE-2002-0651

URL: http://www.kb.cert.org/vuls/id/542971

Short Name

SHELLCODE:X86:X90-NOOP-CTS

Severity

Major

Recommended

False

Recommended Action

Drop

SHELLCODE: x86 Intel Architecture Instruction Set NOOP Slide (TCP-CTS)

Extended Description

Affected Products

References

Found a potential security threat?