【MS】MS05-038 IE COM Objects Instantiation

■脆弱性の説明MS05-038

http://www.microsoft.com/japan/technet/security/Bulletin/MS05-038.mspx

http://xforce.iss.net/xforce/bulletins/microsoft/MS05-038

■攻撃元(受動的攻撃)

192.168.221.110　RedHat

■攻撃対象

192.168.221.180　Win2K+SP4

■実証コード

C:\C>MS05-038.pl > test.html

■Proventia

DHTML_Object_Overflow
http://xforce.iss.net/xforce/xfdb/19831

HTML_IE_ActiveX_Loader_Heap_Corruption

http://xforce.iss.net/xforce/xfdb/21307

Event Number : 1
Date/Time : 2006-01-04 18:23:43 JST
Tag Name : DHTML_Object_Overflow
Alert Name : DHTML_Object_Overflow
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.221.106
Target Object Name : 8287
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.110
SourcePort Name : 80
Sensor DNS Name : iss-sp2
Sensor IP Address : 10.4.6.100
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 1
Attribute Name : :accessed
Attribute Value : yes
Attribute Name : :code
Attribute Value : 200
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.110
Attribute Name : :intruder-port
Attribute Value : 80
Attribute Name : :protocol
Attribute Value : http
Attribute Name : :server
Attribute Value : 192.168.221.110
Attribute Name : :URL
Attribute Value : /test.html
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.221.106
Attribute Name : :victim-port
Attribute Value : 8287
Attribute Name : algorithm-id
Attribute Value : 2113203
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : LOGEVIDENCE
Attribute Value : Default
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.221.110
Attribute Name : Packet DestinationPort
Attribute Value : 80
Attribute Name : Packet DestinationPortName
Attribute Value : http
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.106
Attribute Name : Packet SourcePort
Attribute Value : 8287

Event Number : 2
Date/Time : 2006-01-04 18:23:43 JST
Tag Name : HTML_IE_ActiveX_Loader_Heap_Corruption
Alert Name : HTML_IE_ActiveX_Loader_Heap_Corruption
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.221.106
Target Object Name : 8287
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.110
SourcePort Name : 80
Sensor DNS Name : iss-sp2
Sensor IP Address : 10.4.6.100
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 2
Attribute Name : :accessed
Attribute Value : yes
Attribute Name : :code
Attribute Value : 200
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.110
Attribute Name : :intruder-port
Attribute Value : 80
Attribute Name : :protocol
Attribute Value : http
Attribute Name : :server
Attribute Value : 192.168.221.110
Attribute Name : :URL
Attribute Value : /test.html
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.221.106
Attribute Name : :victim-port
Attribute Value : 8287
Attribute Name : algorithm-id
Attribute Value : 2106196
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : LOGEVIDENCE
Attribute Value : Default
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.221.110
Attribute Name : Packet DestinationPort
Attribute Value : 80
Attribute Name : Packet DestinationPortName
Attribute Value : http
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.106
Attribute Name : Packet SourcePort
Attribute Value : 8287

■snort検知

N/A