SID 1:45205

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER HP Data Protector Express DtbClsLogin buffer overflow attempt

Rule Explanation

This event is generated when a rule detects an attempt to generate a buffer overflow in HP Data Protector Express Impact: Attempted User Privilege Gain Details: Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before build 56906 allows local users to gain privileges or cause a denial of service via unknown vectors. This rule searches for an initial opcode in the connection towards the server and then searches for any given data greater then 240 bytes Ease of Attack: Medium

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group