Sid 1-43608

Rule Documentation
References

Rule Category

FILE-OTHER -- Snort detected traffic targeting vulnerabilities in a file type that does not require enough rule coverage to have its own category.

Alert Message

FILE-OTHER Multiple products SGI ZSIZE header information overflow attempt

Rule Explanation

This event is generated when an overflow is detected in the SGI ZSIZE header of an ImageMagick file. Impact: Attempted User Privilege Gain Details: Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

CVE-2006-4144 CVE-2018-5040

Additional Links

helpx.adobe.com/security/products/acrobat/APSB18-21.html

Rule Vulnerability

CVE Additional Information

CVE-2006-4144

Integer overflow in the ReadSGIImage function in sgi.c in ImageMagick before 6.2.9 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via large (1) bytes_per_pixel, (2) columns, and (3) rows values, which trigger a heap-based buffer overflow.

Details
Severity	LOW	Base Score	2.6
Impact Score	2.9	Exploit Score	4.9
Confidentiality Impact	NONE	Integrity Impact	NONE
Availability Impact	PARTIAL	Access Vector
Authentication	NONE	Ease of Access

CVE-2018-5040

Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Details
Severity		Base Score	8.8
Impact Score	5.9	Exploit Score	2.8
Confidentiality Impact	HIGH	Integrity Impact	HIGH
Availability Impact	HIGH	Access Vector
Authentication		Ease of Access