New sig 5757 - Outlook cross-site scripting - lots of FPs

[jkell]

Receiving lots of apparent FPs for 5757. I don't see any nulls (encoded or otherwise) in the payload, and it's flagging a chunk of an SMTP conversation.

Example logged payload included.

[wsulym]

Well that was some timing.... I just finished up the mods to the sig and its ready to go. It'll be in s246.

[mcvosi]

Excellent!

Thanks!

[jkell]

Timing? I just disabled it yesterday to remove the annoyance factor (plus I got an extra-large burst of them this week).

Will have to remember to re-enable it now when S246 rolls out...

Thanks :)

[jeff.johnson]

Yes, thank you! I too was seeing a large number of these signatures fired.

[mcvosi]

Well, I think I'm seeing less of them with S246, but I'm still getting them.

[wsulym]

Credit where credit is due, Daniel Fabian of SEC Consult Unternehmensberatung GmbH has his name attached to the public published disclosure of this vulnerability. This is erratic null byte handling by OWA.

If you can turn on verbose alerting for the signature and supply me a few alerts (you can send directly to me at wsulym@cisco.com) I can take another look at it and see if there's anything we can do.

I'm not seeing the traffic you are as I had the new version running for a couple of weeks prior to s246 and not a single trigger.

As much as I hate saying this, there's just not a whole lot to trigger from based on the vulnerability. But, if you aren't running OWA, I would turn this signature off.

[jkell]

I'm not getting alerts now after re-enabling wiht S246. My FP problem appears to have been fixed :-) Thanks!

[jkell]

I spoke too soon. I have 822 alerts this morning :-(

[mcvosi]

E-mailed you some pcaps.