2535.txt

This is the snapshot of Snot Latest Rules

Rule:

--
Sid:
2535

--
Summary:
This rule does not generate an event, it sets a flowbit for use in later rules to ensure a client-server connection using SSLv3 is actually taking place.

--
Impact:
NA

--
Detailed Information:
A vulnerability exists in the handling of SSL Version 3 requests that can be manipulated to cause a DoS condition in various software implementations used on Microsoft operating systems.

The condition exists because of poor error handling routines in the Microsoft Secure Sockets Layer (SSL) library. SSL requests containing an invalid field, sent to vulnerable systems can cause the affected host to stop handling any further requests.

--
Affected Systems:
Microsoft Windows 2000, 2003 and XP systems using SSL

--
Attack Scenarios:
An attcker needs to make an SSL request to an affected system that contains an invalid field.

--
Ease of Attack:
Simple.

--
False Positives:
None known.

--
False Negatives:
None known.

--
Corrective Action:
Apply the appropriate vendor supplied patches

--
Contributors:
Sourcefire Vulnerability Research Team
Matt Watchinski <[e-mail]>
Nigel Houghton <[e-mail]>

--
Additional References:

US-Cert:
http://www.kb.cert.org/vuls/id/150236

--