SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.
SERVER-OTHER OpenSSL TLSv1.1 heartbeat read overrun attempt
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug. Impact: CVSS base score 5.0 CVSS impact score 2.9 CVSS exploitability score 10.0 confidentialityImpact PARTIAL integrityImpact NONE availabilityImpact NONE Details: Ease of Attack:
This rule is triggered when a malicious Heartbeat Extension packet is sent to an server.
No public information
No known false positives
Talos research team. This document was generated from data supplied by the national vulnerability database, a product of the national institute of standards and technology. For more information see [nvd].
No rule groups
CVE-2014-0160 |
Loading description
|
Tactic: Collection
Technique: Data from Local System
For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org