SID 1:33654

Report a false positive

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER OpenSSH maxstartup threshold potential connection exhaustion denial of service attempt

Rule Explanation

This rule looks for repeated handshakes to an OpenSSH server.

What To Look For

This rule alerts on malicious traffic that attempts to exploit brute-force activity inside of OpenSSH

Known Usage

Attacks/Scans seen in the wild

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

Rule Groups

MITRE::ATT&CK Framework::Enterprise::Impact::Endpoint Denial of Service::Application or System Exploitation

Rule Categories::Operating Systems::Linux

Rule Categories::Server::Other

CVE

CVE-2010-5107 CVE-2024-6387

Rule Vulnerability

Memory Corruption

Memory Corruption is any vulnerability that allows the modification of the content of memory locations in a way not intended by the developer. Memory corruption results are inconsistent; they could lead to fatal errors and system crashes or data leakage; some have no effect at all.

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2010-5107
 Loading description
CVE-2024-6387
 Loading description