[Full-Disclosure] Exploit Identification Request
blancher at cartel-securite.fr
Thu Apr 29 15:26:08 BST 2004
Le jeu 29/04/2004 à 15:34, System Administrator a écrit :
> One of our external systems (W2k, fully patched all components -
> sp4, sql sp4, mdac sp3, post hotfixes, etc) is being hit by what
> appears to be a buffer overflow of IIS : 4096 bytes cycling in
> what appears to be an attempt to execute code. The probe starts by
> obtaining an index.asp page, and then drops a "SEARCH / 411 210
> 42" before dropping the "AAAAA<n>" string.
> SEARCH /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA[...]
Looks like Windows ntdll.dll buffer overflow exploit :
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!
Full-Disclosure is hosted and sponsored by Secunia.