MS04-007

[pbobby]

Using the two variations of the ms04-007 poc code I've found, I created a custom signature to detect the ASN overflow.

string.tcp engine

ports: 135-139,445

regex: \xA1\x05\x23\x03\x03\x01\x07

Works with both variations so far

[mcerha]

We are in the process of creating an emergency signature update to address this problem. It will hopefully be out sometime this evening. I will post here when the update is ready.

[mcerha]

Signature S70 is being uploaded to CCO. It should be available shortly.