SID 1:16642

Report a false positive

Rule Category

POLICY-OTHER --

Alert Message

POLICY-OTHER file URI scheme attempt

Rule Explanation

This rule searches for `file://` in the file_data buffer and alerts if the pattern is found. Apple Safari before 5.1.1 did not enforce an intended policy for 'file:' URLs, which allows remote attackers to execute arbitrary code via a crafted web site.

What To Look For

This rule alerts when a URI scheme containing the 'file://' prefix is detected.

Known Usage

No public information

False Positives

Known false positives, with the described conditions

This rule does not account for valid use cases of the 'file://' URI scheme.

Contributors

Cisco Talos Intelligence Group

Rule Groups

No rule groups

CVE

CVE-2011-3230

Additional Links

tools.ietf.org/html/rfc1630
tools.ietf.org/html/rfc1738

Rule Vulnerability

Memory Corruption

Memory Corruption is any vulnerability that allows the modification of the content of memory locations in a way not intended by the developer. Memory corruption results are inconsistent; they could lead to fatal errors and system crashes or data leakage; some have no effect at all.

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2011-3230
 Loading description

MITRE ATT&CK Framework

Tactic: Initial Access

Technique: Drive-by Compromise

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org