SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.
SERVER-WEBAPP Dahua DVR channel information query attempt
This event is generated when a Dahua DVR, or potentially another DVR leveraging the same binary protocol, is being sent a request to query for information about channels used by the camera. Specifically this returns channel names. At this time, requests sent over this protocol are unauthenticated. Impact: Attempted Information Leak Details: An attacker sends a command to the vulnerable DVR and since the request is unauthenticated, the DVR executes the request. In this case the request is to query the channel information, which will return the names of the channels. The rule looks for the following: 0xA8000000 -> Command dword 0x00000000 -> Null dword 0x00000000 -> Specifier for command (denotes channel info) Two dwords of nulls: 0x00000000 0x00000000 Ease of Attack: Simple and publicly available.
No information provided
No public information
No known false positives
Cisco Talos Intelligence Group
No rule groups
CVE-2013-3615 |
Loading description
|
CVE-2013-6117 |
Loading description
|