David Marcus
Director, Security Research
Dave Marcus currently serves as Director of Security Research for McAfee® Labs, focusing on bringing McAfee’s ...
|
|
Due to the MS08-067 out-of-cycle release from Microsoft today we are in the process of releasing emergency DATs/coverage updates for many of our products and technologies. We are also working on an emergency Security Advisory as well.
Current state for each of the content areas is as follows:
Malware – Emergency DAT cut and testing in progress. ETA of 2 – 3 hours.
HIPS – Generic buffer overflow should provide coverage.
Intrushield – Partial existing coverage. Additional emergency sigset releasing today.
Foundstone – Emergency signatures being released today.
V-Flash – Emergency signatures being released today.
MNAC – Emergency signatures being released today.
VirusScan Enterprise BOP – Should provide coverage for the buffer overflow.
We will continue to monitor this critical event to provide the most comprehensive coverage we can.
|
|
After testing a PoC vulnerability exploit against a Windows XP computer with SP3 and DEP enabled, I found that VirusScan 8.x buffer overflow protection also blocks the exploit attack.
After testing with PoC vulnerability code for this issue, I have found that existing HIPS signatures cover this issue with signature ID 3768, “Windows Server Service Buffer Overflow Vulnerability (Tighter Security)”, resulting in a Prevent action by default.
This is due to the similarity between MS08-067 and the MS06-040 this signature originally covered.
Submit your own comments / message for this post