TMS zl Module IPS/IDS Signature Reference Guide RLX.10.2.2.94

ProCurve TMS zl Module IPS/IDS Signature
Reference Guide Version RLX.10.2.2.94
660
Signature ID: 30032
Microsoft Windows mhtml: URI Buffer Overflow Vulnerability
Threat Level: Warning
Industry ID: CVE-2006-2766 Bugtraq: 18198 Nessus: 22185
Signature Description: This vulnerability is caused due to a boundary error in inetcomm.dll when processing URLs
with the mhtml: URI handler. This can be exploited to cause a stack-based buffer overflow via an overly long URL by
tricking a user into visiting a malicious web site with Internet Explorer or opening a specially crafted Internet shortcut.
Successful exploitation allows execution of arbitrary code.
Signature ID: 30033
MS Internet Explorer XML Core Services ActiveX control Unicode Access
Threat Level: Warning
Industry ID: CVE-2006-5745 Bugtraq: 20915
Signature Description: Microsoft XML core services contains a vulnerability that can allow a remote attacker to
execute arbitrary code. The vulnerability is caused due to an error in XML HTTP 4.0 ActiveX Control (msxml4.dll)
within the setRequestHeader() method. An attacker can entice users to visit specially crafted Web site to execute
arbitrary code
Signature ID: 30034
Microsoft Windows Address Book (WAB) File Format Parsing Vulnerability
Threat Level: Severe
Industry ID: CVE-2006-0014 Bugtraq: 17459
Signature Description: The specific flaw exists during the parsing of malformed Windows Address Book (.WAB) files.
Modification of the length value of certain Unicode strings within this file format results in an exploitable heap
corruption. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of the Microsoft
Windows operating system.
Signature ID: 30035
Microsoft Publisher pub file download attempt
Threat Level: Warning
Industry ID: CVE-2006-0001
Bugtraq: 19951
Signature Description: Microsoft Publisher is a lightweight desktop publishing (DTP) application bundled with
Microsoft Office Small Business and Professional. The application facilitates the design of professional business and
marketing communications via familiar Office tools & functionality. Microsoft Publisher is susceptible to a remote,
arbitrary code execution vulnerability that yields full system access running in the context of a target user.
Signature ID: 30036
OpenLDAP Server Bind Request Denial Of Service Vulnerability
Threat Level: Warning
Industry ID: CVE-2006-5779 Bugtraq: 20939
Signature Description: OpenLDAP is an open source implementation of the Lightweight Directory Access Protocol
(LDAP). A memory corruption vulnerability exists in OpenLDAP server version 2.2.29 that would can cause a denial
of service attack. The vulnerability is due to an assertion failure while processing credentials string sent by a client
during the MD5-CRAM authentication method. By sending a specially crafted LDAP bindRequest message containing
a large credentials string a remote attacker can exploit this vulnerability. Vendor has released patches to address this
vulnerability.