Signature Detail
Short Name |
SMTP:MAL:DATA-SCHEME |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
SMTP |
Keywords |
malware http data scheme |
Release Date |
2005/01/13 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
SMTP: HTML "data:" URL Scheme
This signature detects an e-mail containing a HTML document containing parameters using the "data:" URL scheme. This scheme is defined in RFC2397 and is a legitimate usage of HTML. However, attackers can use the scheme to first embed malware in a Web page, then bypass specific filters that normally detect such a delivery.
Extended Description
None
References