Sig5813 Vector Markup Language Vulnerability - False Positives?

enelson · ‎09-29-2006

Seeing alot of activity with regard to this new vulnerability. The sensor is denying packets. The html is usually in the "Context" of the packet. Has anyone seen false positives for this signature?

<html xmlns:v="urn:schemas-microsoft-com:vm

jlimbo · ‎09-29-2006

Just to confirm is this subsig 5813-0? Or another subsignature.

Would you be able to provide the triggering packet through a produce verbose alert or even better a traffic sample?

enelson · ‎09-30-2006

Over 2200 alerts since the signature was intruduced.

These are ALL subsig 0.

We use Security Monitor to display our events.

Will Verbose alerts show in Secmon under ALERT DETAILS after enabled for this signature? (evIdsalert)

mkirbyii · ‎09-30-2006

There is a bug in Ciscoworks VMS Security Monitor, Secmon will always display subsig 0. The bug does not show the proper subsig. To determine the correct subsig you will need to obtain the event from the sensor itself using "show events" command.

M