?? 3560.txt
字號:
Rule:--Sid:3560--Summary:This rule should not generate an event.--Impact:Execution of arbitrary code leading to full administrator access of the machine. Denial of Service (DoS).--Detailed Information:When an attempt is made to bind to the Microsoft Message Queuing (MSMQ)system over a network connection, this rule sets a flowbit parameter foruse in other rules.A programming error in the MSMQ subsystem may present an attacker withthe opportunity to overflow a fixed length buffer and execute code oftheir choosing on an affected host.This rule should not generate an event.--Affected Systems: Windows 98 and 98SE Windows 2000 sp 3 and sp 4 Windows XP--Attack Scenarios:--Ease of Attack:Simple. Expoit code exists.--False Positives:None known.--False Negatives:None known.--Corrective Action:Apply the appropriate vendor supplied patches.Block access to RPC ports 135, 139 and 445 for both TCP and UDP protocols from external sources using a packet filtering firewall.--Contributors:Sourcefire Vulnerability Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:--
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -