Re: new internet explorer exploit (was new worm)
Void <void@xxxxxxxx> wrote:
> Just wanted to add that Norton Anti-Virus 2004 will detect this exploit and
Of course, what you mean is "this specific exploit".
You wouldn't -- unlike the snake-oilers at Symantec (and many other AV
companies) -- want to imply that its detection of the specific exploit
instance you tested (i.e. using Jelmer's example) is any kind of
indication of NAV's (etc...) detection of any and all possible exploits
of this vulnerability now, would you??
> pop up a warning, but also fails to halt its execution or protect the user
> in any way.
Oh joy...
> Here is what it thinks it is:
>
> http://securityresponse.symantec.com/avcenter/venc/data/bloodhound.exploit.6.html
>
> So there is some measure of warning, but no real protection.
You mean, of course, "there is some level of warning against sonme
unknown portion (perhaps as small a one over ininfity) of possible
exploits of this vulnerability".
I guess the handy thing, at least historically, is that the dweebs that
have used such things in their viruses and worms have tended to copy
the PoC examples as near as damnit to the letter, so have tended to be
prematurely detected.
Of course, _this_ exploit was discovered, analysed and somewhat fully
documented by the likes of "http-equiv" and Jelmer _AFTER_ it had been
discovered by someone else, not publicized and then used in a rather
"successful" worm. So maybe the writer of that worm is not one of your
typical skiddie types and the number of not publicly known functional
exploits of this vuln that are not detected by NAV, etc is worrying
higher than usual?
--
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854