Rule:

--
Sid:
1102

--
Summary:
This event is generated when an attempt is made to exploit a known vulnerability in the peer to peer (p2p) client eMule.

--
Impact:
Possible execution of arbitrary code of the attackers choosing.

--
Detailed Information:
This event is generated when an attempt is made to exploit a known vulnerability in the p2p application eMule. The eMule client is prone to a buffer overflow condition which may present an attacker with the opportunity to execute code of their choosing on a vulnerable host.

The issue surrounds the IRC module and the Web server portions of the client. Sufficient bounds checking of user supplied data is not correctly implemented causing the opportunity to overflow a buffer.

--
Affected Systems:
All systems using eMule.

--
Attack Scenarios:
An attacker can supply overly long data in an IRC session between two clients to trigger the overflow.

--
Ease of Attack:
Simple. Exploits exist.

--
False Positives:
None known.

--
False Negatives:
None known.

--
Corrective Action:
Ensure the system is using an up to date version of the software and has had all vendor supplied patches applied.

Check the host logfiles and application logs for signs of compromise.

--
Contributors:
Sourcefire Vulnerability Research Team
Alex Kirk <alex.kirk@sourcefire.com>
Nigel Houghton <nigel.houghton@sourcefire.com>

--
Additional References:

--
