My next class:

MS13-056 (false positive)? alerts

Published: 2013-08-28. Last Updated: 2013-08-28 18:14:19 UTC
by Bojan Zdrnja (Version: 1)
7 comment(s)

Last month Microsoft patched a pretty nasty vulnerability in DirectShow. Microsoft DirectShow is an API that comes with Windows and that allows applications to display all sorts of graphics files as well as to play streaming media.

The MS13-056 vulnerability was privately reported to Microsoft – it is a remote code execution vulnerability that allows an attacker to craft a malicious GIF file which will exploit the vulnerability. Since the vulnerability allows the attacker to overwrite arbitrary memory it can lead to remote code execution.

It is clear that this is a very serious vulnerability. Initially there were no public exploits however later after the patch was released a proof of concept GIF image which triggers the vulnerability has been published.
All Windows versions are affected (Windows XP/Vista/7/8) so make sure that you have patched your systems against it if you haven't already – the vulnerability can be theoretically easily turned into a drive by exploit.

Now, one of our readers, Sean, reported that his IPS started firing up alerts and detecting MS13-056. Sean captured network traffic and, luckily, the GIF files were benign so these were false positive alerts (which can be annoying too – depending on the number).

We were wondering if anyone else is seeing a lot of such alerts? Any real attacks in the wild? Suspicious traffic? Let us know!

--
Bojan
@bojanz

INFIGO IS

Keywords: 0day ms13056
7 comment(s)
My next class:

Comments

Didn't ms say they were unaware of any built in win tools that were exploitable?

Is this in the snort vrt?
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source

Not to say 3rd party tools won't be
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source

Not to say 3rd party tools won't be
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source

Not to say 3rd party tools won't be
blogs.technet.com/b/srd/archive/2013/07/09/assessing-risk-for-the-july-2013-security-updates.aspx source

Not to say 3rd party tools won't be

Edit: o-oh too many submit clicks
HP's tipping points released signatures a few days ago which have been going nuts for every user that applied them. They haven't released a fix yet, but it's again false positives on benign gif's.
HP TippingPoint released an updated DV last night which appears to have fixed the issue.

Diary Archives