This SonicWALL IPS signature category consists of a group of signatures that can detect and prevent Multimedia based network traffic and content. Often multimedia applications playback streaming audio or video content over a network. These streaming services can choke network bandwidth and present a variety of security and legal liabilities, because the streaming content may be corrupted or inappropriate for the workplace.
Because streaming media applications need to take in parameters to locate the files that they play, they are vulnerable to buffer overflow attacks. With older versions of many media players, attackers could, for example, provide a link with carefully crafted parameters that could cause the player to malfunction and the computer to execute arbitrary code, allowing the attacker to take control of the machine. Recent versions of media players have been proven to be vulnerable to more sophisticated but similar forms of buffer overflow attack. Because these players only need to be installed on the computer for such attacks to function, they can be a significant liability to network security.
SonicWALL multimedia signatures are classified as low priority and are set to "detect" by default. When they are enabled for prevention, they block connection attempts to remote media or playlists, allowing administrators to keep networks clear of bandwidth hogs, reduce security risks, and decrease the chance that users will access inappropriate content.
