Rule:

--
Sid:
1102

--
Summary:
This event is generated when an attempt is made to exploit a known 
vulnerability in the peer to peer (p2p) client eMule.

--
Impact:
Possible execution of arbitrary code of the attackers choosing.

--
Detailed Information:
This event is generated when an attempt is made to exploit a known
vulnerability in the p2p application eMule. The eMule client is prone to
a buffer overflow condition which may present an attacker with the
opportunity to execute code of their choosing on a vulnerable host.

The issue surrounds the IRC module and the Web server portions of the
client. Sufficient bounds checking of user supplied data is not
correctly implemented causing the opportunity to overflow a buffer.

--
Affected Systems:
	All systems using eMule.

--
Attack Scenarios:
An attacker can supply overly long data in an IRC session between two
clients to trigger the overflow.

--
Ease of Attack:
Simple. Exploits exist.

--
False Positives:
None known.

--
False Negatives:
None known.

--
Corrective Action:
Ensure the system is using an up to date version of the software and has
had all vendor supplied patches applied.

Check the host logfiles and application logs for signs of compromise.

--
Contributors:
Sourcefire Vulnerability Research Team
Alex Kirk <alex.kirk@sourcefire.com>
Nigel Houghton <nigel.houghton@sourcefire.com>

--
Additional References:

--