topic Re: MS .ANI Exploit in Network Security

MS .ANI Exploit

mhellman — Sun, 10 Mar 2019 10:32:40 GMT

Snort and ISS have had a signature for this since 2005. Lots of other products appear to detect this as of 2005 as well. Where is the Cisco sig? I found a default disabled/retired sig, (3718-0, Windows .ANI File DoS), but it doesn't appear to work against the latest exploits.

Re: MS .ANI Exploit

wsulym — Sat, 31 Mar 2007 21:40:16 GMT

Signature 5442-0. Available since s137 (January 2005)

Linked and visible from MySDN:

http://tools.cisco.com/MySDN/Intelligence/viewThreat.x?threatId=5384

So far, this fires against all exploits I've seen.

Re: MS .ANI Exploit

Raymond Aragon — Mon, 02 Apr 2007 17:56:11 GMT

Please check the My Self Defending Network link:

www.mysdn.com

It is currently at the top of the page and can be searched for. Here is the Cisco ID: 5384

Pleas use the MYSDN website for security information ther is some good info there.

Regards,

Ray

Re: MS .ANI Exploit

Raymond Aragon — Mon, 02 Apr 2007 17:57:53 GMT

BTW:

Cisco Security Agent has shown to protect against this exploit. It offers some good protection against many DAY Zero exploits without the need for patching per exploit like many AV applications. It works well with AV and is not a replacement for AV.

Regards,

Ray