Snort mailing list archives

Possible FP 17363


From: "Lay, James" <james.lay () wincofoods com>
Date: Mon, 25 Oct 2010 09:41:50 -0600

Rule:

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT
Apple computer finder DMG volume name memory corruption";
flow:to_client,established; content:"|4C 41 42 4C|";
byte_test:2,>,254,12,relative; metadata:policy balanced-ips drop, policy
security-ips drop, service http; reference:cve,2007-0197;
classtype:attempted-user; sid:17363; rev:1;)

 

Rule hit:

10/25-09:36:34.116283  [**] [1:17363:1] WEB-CLIENT Apple computer finder
DMG volume name memory corruption [**] [Classification: Attempted User
Privilege Gain] [Priority: 1] {TCP} 209.85.225.106:80 ->
66.193.105.132:41579

 

Packet dump:

09:36:34.116283 IP 209.85.225.106.80 > 66.193.105.132.41579: Flags [.],
ack 1, win 6432, length 1400

        0x0000:  4500 05a0 ca35 0000 3906 531d d155 e16a
E....5..9.S..U.j

        0x0010:  42c1 6984 0050 a26b 6789 a15d 278f 81de
B.i..P.kg..]'...

        0x0020:  5010 1920 a7a4 0000 6f74 7970 652e 6469
P.......otype.di

        0x0030:  7361 626c 655d 2c5b 6175 2c75 695d 2c5b
sable],[au,ui],[

        0x0040:  6275 2c66 756e 6374 696f 6e28 297b 7265
bu,function(){re

        0x0050:  7475 726e 2074 7970 656f 6620 7466 3d3d
turn.typeof.tf==

        0x0060:  2273 7472 696e 6722 3f74 663a 2265 6e22
"string"?tf:"en"

        0x0070:  7d5d 2c0a 5b54 752c 6478 2e6c 6f61 645d
}],.[Tu,dx.load]

        0x0080:  2c5b 5575 2c64 782e 4772 5d2c 5b56 752c
,[Uu,dx.Gr],[Vu,

        0x0090:  6478 2e63 6c65 6172 5d2c 5b57 752c 6478
dx.clear],[Wu,dx

        0x00a0:  2e43 665d 2c5b 5875 2c64 782e 4a5d 2c5b
.Cf],[Xu,dx.J],[

        0x00b0:  5975 2c64 782e 596c 5d2c 5b5a 752c 6478
Yu,dx.Yl],[Zu,dx

        0x00c0:  2e49 645d 2c5b 2475 2c64 782e 5669 5d2c
.Id],[$u,dx.Vi],

        0x00d0:  5b61 762c 6478 2e54 695d 2c5b 6276 2c64
[av,dx.Ti],[bv,d

        0x00e0:  782e 7a71 5d2c 5b63 762c 6478 2e59 695d
x.zq],[cv,dx.Yi]

        0x00f0:  2c5b 6476 2c64 782e 4a62 5d2c 5b65 762c
,[dv,dx.Jb],[ev,

        0x0100:  6478 2e7a 665d 2c5b 6676 2c64 782e 6765
dx.zf],[fv,dx.ge

        0x0110:  7450 6f6c 796c 696e 655d 2c5b 6776 2c64
tPolyline],[gv,d

        0x0120:  782e 4471 5d2c 5b4c 752c 6778 2e73 686f
x.Dq],[Lu,gx.sho

        0x0130:  775d 2c5b 4d75 2c67 782e 6869 6465 5d2c
w],[Mu,gx.hide],

        0x0140:  5b4e 752c 6778 2e48 5d2c 5b4f 752c 6778
[Nu,gx.H],[Ou,gx

        0x0150:  2e51 625d 2c5b 5075 2c67 782e 7365 7450
.Qb],[Pu,gx.setP

        0x0160:  6172 616d 6574 6572 5d2c 5b4c 762c 6578
arameter],[Lv,ex

        0x0170:  2e6c 795d 2c5b 4d76 2c65 782e 5249 5d2c
.ly],[Mv,ex.RI],

        0x0180:  5b4e 762c 6578 2e59 495d 2c5b 5176 2c66
[Nv,ex.YI],[Qv,f

        0x0190:  782e 6869 6465 5d2c 5b52 762c 6678 2e73
x.hide],[Rv,fx.s

        0x01a0:  686f 775d 2c5b 5376 2c66 782e 485d 2c5b
how],[Sv,fx.H],[

        0x01b0:  5476 2c66 782e 7643 5d2c 5b55 762c 6678
Tv,fx.vC],[Uv,fx

        0x01c0:  2e70 695d 2c5b 5676 2c66 782e 7265 6d6f
.pi],[Vv,fx.remo

        0x01d0:  7665 5d2c 5b57 762c 6678 2e66 6f63 7573
ve],[Wv,fx.focus

        0x01e0:  5d2c 5b58 762c 6678 2e62 6c75 725d 2c5b
],[Xv,fx.blur],[

        0x01f0:  5976 2c66 782e 246c 5d2c 5b5a 762c 6678
Yv,fx.$l],[Zv,fx

        0x0200:  2e4b 6e5d 2c5b 2476 2c66 782e 5461 5d2c
.Kn],[$v,fx.Ta],

        0x0210:  5b61 772c 6678 2e4d 6c5d 2c5b 6277 2c66
[aw,fx.Ml],[bw,f

        0x0220:  782e 636b 5d2c 5b63 772c 6678 2e62 6b5d
x.ck],[cw,fx.bk]

        0x0230:  2c5b 6477 2c66 782e 6944 5d2c 5b65 772c
,[dw,fx.iD],[ew,

        0x0240:  6678 2e63 6d5d 2c5b 6677 2c66 782e 6961
fx.cm],[fw,fx.ia

        0x0250:  5d2c 5b67 772c 6678 2e57 695d 5d3b 0a76
],[gw,fx.Wi]];.v

        0x0260:  6c2e 5265 7475 726e 5661 6c75 6573 3d7b
l.ReturnValues={

        0x0270:  5355 4343 4553 533a 3230 302c 5345 5256
SUCCESS:200,SERV

        0x0280:  4552 5f45 5252 4f52 3a35 3030 2c4e 4f5f
ER_ERROR:500,NO_

        0x0290:  4e45 4152 4259 5f50 414e 4f3a 3630 307d
NEARBY_PANO:600}

        0x02a0:  3b79 6c2e 4572 726f 7256 616c 7565 733d
;yl.ErrorValues=

        0x02b0:  7b4e 4f5f 4e45 4152 4259 5f50 414e 4f3a
{NO_NEARBY_PANO:

        0x02c0:  3630 302c 4e4f 5f50 484f 544f 3a36 3031
600,NO_PHOTO:601

        0x02d0:  2c46 4c41 5348 5f55 4e41 5641 494c 4142
,FLASH_UNAVAILAB

        0x02e0:  4c45 3a36 3033 7d3b 4172 7261 792e 7072
LE:603};Array.pr

        0x02f0:  6f74 6f74 7970 652e 7075 7368 2e61 7070
ototype.push.app

        0x0300:  6c79 2848 772c 6675 6e63 7469 6f6e 2829
ly(Hw,function()

        0x0310:  7b76 6172 2061 3d5b 5d3b 613d 612e 636f
{var.a=[];a=a.co

        0x0320:  6e63 6174 2868 7728 2929 3b61 3d61 2e63
ncat(hw());a=a.c

        0x0330:  6f6e 6361 7428 6a77 2829 293b 7265 7475
oncat(jw());retu

        0x0340:  726e 2061 3d61 2e63 6f6e 6361 7428 6c77
rn.a=a.concat(lw

        0x0350:  2829 297d 2829 293b 0a72 662e 7075 7368
())}());.rf.push

        0x0360:  2866 756e 6374 696f 6e28 6129 7b51 6428
(function(a){Qd(

        0x0370:  612c 7977 2c7a 772c 4177 2c47 772c 6878
a,yw,zw,Aw,Gw,hx

        0x0380:  2c48 772c 7877 297d 293b 6675 6e63 7469
,Hw,xw)});functi

        0x0390:  6f6e 2069 7828 612c 6229 7b76 6172 2063
on.ix(a,b){var.c

        0x03a0:  3d6e 6577 2056 693b 632e 6d61 7054 7970
=new.Vi;c.mapTyp

        0x03b0:  6573 3d62 7c7c 693b 4466 2e63 616c 6c28
es=b||i;Df.call(

        0x03c0:  7468 6973 2c61 2c63 293b 4428 7468 6973
this,a,c);D(this

        0x03d0:  2c4b 612c 6675 6e63 7469 6f6e 2864 2c66
,Ka,function(d,f

        0x03e0:  297b 7628 7468 6973 2c4a 612c 7468 6973
){v(this,Ja,this

        0x03f0:  2e66 6528 6429 2c74 6869 732e 6665 2866
.fe(d),this.fe(f

        0x0400:  2929 7d29 7d0a 4328 6978 2c44 6629 3b6c
))})}.C(ix,Df);l

        0x0410:  3d69 782e 7072 6f74 6f74 7970 653b 6c2e
=ix.prototype;l.

        0x0420:  6449 3d66 756e 6374 696f 6e28 297b 7661
dI=function(){va

        0x0430:  7220 613d 7468 6973 2e56 2829 3b72 6574
r.a=this.V();ret

        0x0440:  7572 6e20 6e65 7720 7328 612e 6c6e 6728
urn.new.s(a.lng(

        0x0450:  292c 612e 6c61 7428 2929 7d3b 0a6c 2e24
),a.lat())};.l.$

        0x0460:  483d 6675 6e63 7469 6f6e 2829 7b76 6172
H=function(){var

        0x0470:  2061 3d74 6869 732e 4a28 293b 7265 7475
.a=this.J();retu

        0x0480:  726e 206e 6577 2078 6428 5b61 2e70 6228
rn.new.xd([a.pb(

        0x0490:  292c 612e 6f62 2829 5d29 7d3b 0a6c 2e66
),a.ob()])};.l.f

        0x04a0:  4a3d 6675 6e63 7469 6f6e 2829 7b76 6172
J=function(){var

        0x04b0:  2061 3d74 6869 732e 4a28 292e 6962 2829
.a=this.J().ib()

        0x04c0:  3b72 6574 7572 6e20 6e65 7720 4128 612e
;return.new.A(a.

        0x04d0:  6c6e 6728 292c 612e 6c61 7428 2929 7d3b
lng(),a.lat())};

        0x04e0:  0a6c 2e4f 673d 6675 6e63 7469 6f6e 2829
.l.Og=function()

        0x04f0:  7b72 6574 7572 6e20 7468 6973 2e66 6528
{return.this.fe(

        0x0500:  7468 6973 2e49 2829 297d 3b0a 6c2e 5861
this.I())};.l.Xa

        0x0510:  3d66 756e 6374 696f 6e28 6129 7b69 6628
=function(a){if(

        0x0520:  7468 6973 2e6a 6128 2929 4466 2e70 726f
this.ja())Df.pro

        0x0530:  746f 7479 7065 2e58 612e 6361 6c6c 2874
totype.Xa.call(t

        0x0540:  6869 732c 6129 3b65 6c73 6520 7468 6973
his,a);else.this

        0x0550:  2e67 473d 617d 3b0a 6c2e 4846 3d66 756e
.gG=a};.l.HF=fun

        0x0560:  6374 696f 6e28 612c 6229 7b76 6172 2063
ction(a,b){var.c

        0x0570:  3d6e 6577 204e 2861 2e79 2c61 2e78 293b
=new.N(a.y,a.x);

        0x0580:  6966 2874 6869 732e 6a61 2829 297b 7661
if(this.ja()){va

        0x0590:  7220 643d 7468 6973 2e66 6528 6229 3b74
r.d=this.fe(b);t

 

Looks like google maps to me.

 

 

James Lay

IT Security Analyst

WinCo Foods

208-672-2014 Office

208-559-1855 Cell

650 N Armstrong Pl.

Boise, Idaho 83704

 

------------------------------------------------------------------------------
Nokia and AT&T present the 2010 Calling All Innovators-North America contest
Create new apps & games for the Nokia N8 for consumers in  U.S. and Canada
$10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store 
http://p.sf.net/sfu/nokia-dev2dev
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs

Current thread: