Rule:--Sid:2518--Summary:This event is generated when an attempt is made to exploit a knownvulnerability in the Microsoft implementation of the PrivateCommunications Transport (PCT) protocol.--Impact:Execution of arbitrary code. Unauthorized administrative access to anaffected host.--Detailed Information:A vulnerability exists in the handling of PCT requests thatcan be manipulated to give an attacker the opportunity to executearbitrary code of their choosing leading to a possible remoteadministrative compromize of an affected host.The condition exists because of poor error handling routines in theMicrosoft Secure Sockets Layer (SSL) library.--Affected Systems:	Microsoft Windows NT, 2000, 2003 and XP systems using PCT--Attack Scenarios:An attcker needs to make a specially crafted PCT request to an affected system.--Ease of Attack:Simple.--False Positives:None known.--False Negatives:None known.--Corrective Action:Apply the appropriate vendor supplied patchesDisable the use of PCT--Contributors:Sourcefire Vulnerability Research TeamMatt Watchinski <mwatchinski@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:Microsoft:http://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Gaobothttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Sasserhttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Korgohttp://www.microsoft.com/security/encyclopedia/details.aspx?name=win32/rbothttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Sdbothttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Mytobhttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Spybothttp://www.microsoft.com/security/encyclopedia/details.aspx?name=Win32/Wootbot--