2459.txt

来自「This is the snapshot of Snot Latest Rule」· 文本 代码 · 共 53 行

Rule:

--
Sid:
2459

--
Summary:
This event is generated when a host in your network that has Yahoo Instant Messenger running starts a webcam or sends an invitation to view a webcam to another Yahoo IM user. 

--
Impact:
Possible policy violation.  Instant Messenger programs may not be appropriate in certain network environments.

--
Detailed Information:
This event indicates that a Yahoo IM user in your network is sending a notification that he or she is starting a webcam or offering an invitation to view the webcam.  While there are no known exploits associated with showing or viewing webcams, it is possible that this activity is inappropriate in certain environments.

--
Affected Systems:
Any host running Yahoo Instant Messenger.

--
Attack Scenarios:
No know attack scenarios.

--
Ease of Attack:
No know attack scenarios.

--
False Positives:
None Known.

--
False Negatives:
It may be possible for Yahoo IM traffic to use other ports than the default expected ones.  

--
Corrective Action:
Disallow the use of IM clients on the protected network and enforce or implement an organization wide policy on the use of IM clients.

--
Contributors:
Sourcefire Vulnerability Research Team
Judy Novak <[e-mail]>
--
Additional References:
Yahoo Protocol
http://www.cse.iitb.ac.in/~varunk/YahooProtocol.htm

--