Rule:--Sid:2577--Summary:This event is generated when an attempt is made to exploit a known vulnerability in Microsoft Internet Explorer.--Impact:Serious. Execution of arbitrary code may be possible.--Detailed Information:Internet Explorer does not correctly handle the validation of data froman external source when processing data in a frame from a redirectedsource. This may lead to the execution of arbitrary code in the contextof the Local Machine zone.It may be possible for an attacker to supply an HTTP 300 response from awebserver that points to a local file on the victim host. If theattacker includes code of their choosing, this code is executed in thecontext of the trusted Local Machine zone.--Affected Systems:	Microsoft Internet Explorer	Microsoft Outlook	Microsoft Outlook Express--Attack Scenarios:An attacker would need to supply an HTTP 300 series code to redirect thecontents of a frame to a local resource on the victim host.--Ease of Attack:Simple. Exploits exist.--False Positives:A valid 300 server response that uses the Location parameter to redirectusers to a new location may generate an event.--False Negatives:None known.--Corrective Action:Ensure the system is using an up to date version of the software and hashad all vendor supplied patches applied.Disable Active Scripting and ActiveXDisable the use of HTML emailUse a browser other than Internet Explorer--Contributors:Original Snort documentation contributed by nnposter@users.sourceforge.netSourcefire Vulnerability Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:--