SID 1:50892

Rule Category

FILE-MULTIMEDIA -- Snort detected traffic targeting vulnerabilities in multimedia files (mp3, movies, wmv, etc.).

Alert Message

FILE-MULTIMEDIA Microsoft Windows mp3 file malformed ID3 APIC header code execution attempt

Rule Explanation

This event is generated when an MP3 file is detected containing ID3 metadata which exploits a vulnerability in WMVCore component of Windows. Impact: Arbitrary code execution in the context of the current user Details: Ease of Attack: Simple

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group