Signature Detail

SHELLCODE: X86 PexCall Encoder Routine Over TCP-CTS

This signature detects payloads being transferred over network that have been encoded using x86 PexCall Encoder routine. This may be an indication of someone trying to evade anti-virus/IPS solutions and possibly drop malicious code.

Extended Description

Multiple buffer overflows in TrackerCam 5.12 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) an HTTP request with a long User-Agent header or (2) a long argument to an arbitrary PHP script.

Affected Products

• Trackercam trackercam up to 5.12

References

• BugTraq: 12592
• CVE: CVE-2005-0478
• URL: http://secunia.com/advisories/47901/
• URL: http://metasploit.com/
• URL: http://aluigi.altervista.org/adv/tcambof-adv.txt
• URL: http://www.idefense.com/application/poi/display?id=234&type=vulnerabilities
• URL: http://aluigi.altervista.org/adv/r4_1-adv.txt