I am looking into the bufferoverflow events in CSA and need your assistance in this one.
Here is the event:
The application 'C:\Program Files\Internet Explorer\iexplore.exe' (***) tried to call the function VirtualProtectEx("<self>") from a buffer (the return address was 0x7c108ec9). The code at this address is 'ff7510ff 750cff75 086affe8 75ffffff 5dc21000 90909090 90e9733c 9093807c'
Is this action is very suspicious since the VirtualProtectEx function changes the access protection on a region of committed pages in the virtual address space of a specified process.?
Is it possible to figure out what does the code 'ff7510ff 750cff75 086affe8 75ffffff 5dc21000 90909090 90e9733c 9093807c' means?
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...