312-50V9 · Question #564
Study the snort rule given below: From the options below, choose the exploit against which this rule applies.
The correct answer is C. MS Blaster. The Snort rule targets traffic associated with the MS Blaster worm, which exploited the Windows DCOM RPC buffer overflow vulnerability (MS03-026) on TCP port 135.
Question
Study the snort rule given below:
From the options below, choose the exploit against which this rule applies.
Exhibit
Options
- AWebDav
- BSQL Slammer
- CMS Blaster
- DMyDoom
How the community answered
(41 responses)- A7% (3)
- B2% (1)
- C73% (30)
- D17% (7)
Why each option
The Snort rule targets traffic associated with the MS Blaster worm, which exploited the Windows DCOM RPC buffer overflow vulnerability (MS03-026) on TCP port 135.
WebDAV exploits target HTTP/HTTPS ports (80/443) using malformed WebDAV requests, not the DCOM RPC service port pattern matched by this rule.
SQL Slammer propagated via a UDP buffer overflow targeting MS SQL Server on UDP port 1434, which is a completely different protocol, port, and payload signature.
MS Blaster (W32.Blaster.Worm) exploited CVE-2003-0352, a buffer overflow in the Windows DCOM RPC service listening on TCP port 135. Snort rules for this worm match on the specific shellcode pattern and destination port 135 (or the backdoor on TCP 4444) used during exploitation and propagation.
MyDoom was a mass-mailing email worm that spread via SMTP attachments and opened a backdoor on TCP port 3127, not DCOM RPC traffic.
Concept tested: Snort rule identification for MS Blaster worm
Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-026
Topics
Community Discussion
No community discussion yet for this question.