[31575] in bugtraq
Re: BAD NEWS: Microsoft Security Bulletin MS03-032
daemon@ATHENA.MIT.EDU (Crist J. Clark)
Fri Sep 12 17:56:27 2003
Date: Fri, 12 Sep 2003 13:59:59 -0700
From: "Crist J. Clark" <cristjc@comcast.net>
To: Drew Copley <dcopley@eeye.com>
Cc: "'Nathan Wallwork'" <owen@pungent.org>,
"'GreyMagic Software'" <security@greymagic.com>,
"'Bugtraq'" <bugtraq@securityfocus.com>,
full-disclosure@lists.netsys.com, http-equiv@excite.com,
"'NTBugtraq'" <NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM>,
vulnwatch@vulnwatch.org
Message-ID: <20030912205959.GA43499@blossom.cjclark.org>
Reply-To: cjclark@alum.mit.edu
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <000001c37714$2285a120$2b02a8c0@dcopley>
On Tue, Sep 09, 2003 at 01:51:25PM -0700, Drew Copley wrote:
> > -----Original Message-----
> > From: Nathan Wallwork [mailto:owen@pungent.org]
> > Sent: Tuesday, September 09, 2003 1:18 PM
> >
> > On Mon, 8 Sep 2003, Drew Copley wrote:
> > > The only sure way to detect this, I already wrote about [to
> > Bugtraq].
> > > That is by setting a firewall rule which blocks the
> > dangerous mimetype
> > > string
> > > [Content-Type: application/hta]. Everything else in the
> > exploit can change.
> >
> > Just so we are clear, the firewall wouldn't tbe he right
> > place to catch
> > this because that string could be split by packet
> > fragmentation, so you'd
> > need to look for it at an application level, after the data stream
> > has been reassembled.
>
> Yes, I mean "IPS rule" - "firewall rule" is a bit inaccurate- just a
> traditional term. Any IPS that does not handle fragmentation, though, has
> some serious problems.
s/fragmentation/fragmentation and TCP reassembly/
You'd need both, and they are different things.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
