GEN:SID 1:2584
Message EXPLOIT eMule buffer overflow attempt
Summary This event is generated when an attempt is made to exploit a known
vulnerability in the peer to peer (p2p) client eMule.
Impact Possible execution of arbitrary code of the attackers choosing.
Detailed Information This event is generated when an attempt is made to exploit a known
vulnerability in the p2p application eMule. The eMule client is prone to
a buffer overflow condition which may present an attacker with the
opportunity to execute code of their choosing on a vulnerable host.

The issue surrounds the IRC module and the Web server portions of the
client. Sufficient bounds checking of user supplied data is not
correctly implemented causing the opportunity to overflow a buffer.
Affected Systems All systems using eMule.
Attack Scenarios An attacker can supply overly long data in an IRC session between two
clients to trigger the overflow.
Ease of Attack Simple. Exploits exist.
Corrective Action Ensure the system is using an up to date version of the software and has
had all vendor supplied patches applied.

Check the host logfiles and application logs for signs of compromise.
Additional References  
Rule References bugtraq: 10039
nessus: 12233