topic Trigger for Sig 33439 - IE Memory Corruption Vulnerability in Network Security

Trigger for Sig 33439 - IE Memory Corruption Vulnerability

Jonathan Grant — Sun, 10 Mar 2019 12:28:38 GMT

Hello all! Sig 33439 was modified in S592 and I'm seeing a lot more alerts from this signature since we pushed S592. Does anyone know what changed and what the trigger is that causes the signature to fire? I have capture files and have not been able to identify anything malicious, nor what is causing it to fire. If anyone can help me understand what the trigger is, I'm hoping I'll be able to identify what in the packets are causing the possible false-positives. Thank you.

Jonathan

Trigger for Sig 33439 - IE Memory Corruption Vulnerability

mark.barrett — Wed, 14 Sep 2011 22:29:09 GMT

I've noticed this as well. As long as all machines running IE have the necessary patches, it shouldn't be a real problem but would be nice to know what's causing all the noise since S592 came out.

Trigger for Sig 33439 - IE Memory Corruption Vulnerability

mzeiser — Thu, 15 Sep 2011 09:41:18 GMT

We're working on this signature already and will update it shortly.

Martin

IPS Signature Team

Trigger for Sig 33439 - IE Memory Corruption Vulnerability

Jonathan Grant — Thu, 15 Sep 2011 13:17:22 GMT

Martin,

Just to confirm, are you saying the current signature is misconfigured and it will be corrected in a future release? Thank you.

Jonathan

Trigger for Sig 33439 - IE Memory Corruption Vulnerability

Hugo Caye — Fri, 16 Sep 2011 12:58:15 GMT

Hi there,

We have the same issue here with several customers during the last two weeks.

We waited for signatures updates if it was fixed but no luck.

We disabled the signature in some customers.

Any suggestion?

Thanks,

Hugo

Trigger for Sig 33439 - IE Memory Corruption Vulnerability

Jonathan Grant — Fri, 16 Sep 2011 13:22:45 GMT

I'll open a service request with TAC and to see if I can get any clarification or more information. I'll let y'all know what I find out.

Jonathan

Re: Trigger for Sig 33439 - IE Memory Corruption Vulnerability

Hugo Caye — Fri, 16 Sep 2011 13:28:15 GMT

OK, thanks.

Re: Trigger for Sig 33439 - IE Memory Corruption Vulnerability

Hugo Caye — Sat, 17 Sep 2011 12:43:00 GMT

Jonathan,

Any input from TAC?

Tks.

Re: Trigger for Sig 33439 - IE Memory Corruption Vulnerability

Jonathan Grant — Mon, 19 Sep 2011 13:06:23 GMT

Hugo,

I opened an SR Friday morning, I received confirmation, but have not heard anything back since. Cisco isn't being very responsive with this query at all.

Jonathan

Re: Trigger for Sig 33439 - IE Memory Corruption Vulnerability

Hugo Caye — Tue, 20 Sep 2011 01:15:55 GMT

Jonathan,

Thanks a lot for your answer.

We’re evaluating to disable this signature.

Regards,

Hugo

Re: Trigger for Sig 33439 - IE Memory Corruption Vulnerability

Daniel Barr — Tue, 20 Sep 2011 13:45:22 GMT

We've had the same uptick in alerts on this signature, and now it's affecting a website that one of our users needs to access. Our systems are patched so I will likely just disable it for now, but I'll definitely watch this thread to see if Cisco updates with any information about a potential re-release of this sig.

Re: Trigger for Sig 33439 - IE Memory Corruption Vulnerability

Daniel Barr — Thu, 22 Sep 2011 21:56:08 GMT

Signature S597 (just released) has retired this signature. I ended up disabling it on our systems anyway.