SID 1:41807

Report a false positive

Rule Category

POLICY-OTHER --

Alert Message

POLICY-OTHER SSLv3 Client Hello attempt

Rule Explanation

The design of the Internet Key Exchange (IKE) protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by (1) monitoring responses before the password is supplied or (2) sniffing, as originally reported for FireWall-1 SecuRemote. Impact: CVSS base score 5.0 CVSS impact score 2.9 CVSS exploitability score 10.0 confidentialityImpact PARTIAL integrityImpact NONE availabilityImpact NONE Details: Ease of Attack:

What To Look For

This rule alerts when an attempt to identify if SSL version 3 is being used by a system.

Known Usage

No public information

False Positives

No known false positives

Contributors

Talos research team. This document was generated from data supplied by the national vulnerability database, a product of the national institute of standards and technology. For more information see [nvd].

Rule Groups

No rule groups

CVE

CVE-2002-1623 CVE-2013-2566

Rule Vulnerability

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2002-1623
 Loading description
CVE-2013-2566
 Loading description

MITRE ATT&CK Framework

Tactic: Discovery

Technique: System Network Configuration Discovery

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org