Create CVE-2010-0805.yar

CVE_Rules/CVE-2010-0805.yar

+rule MSIETabularActivex
+{
+        meta:
+                ref = "CVE-2010-0805"
+                impact = 7
+                hide = true
+                author = "@d3t0n4t0r"
+        strings:
+                $cve20100805_1 = "333C7BC4-460F-11D0-BC04-0080C7055A83" nocase fullword
+                $cve20100805_2 = "DataURL" nocase fullword
+                $cve20100805_3 = /value\=\"http:\/\/(.*?)\"/ nocase fullword
+        condition:
+                ($cve20100805_1 and $cve20100805_3) or (all of them)
+}