SID 1:45440

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER HP LoadRunner remote command execution attempt

Rule Explanation

This event is generated when an unauthenticated user attempts to execute code on HP LoadRunner. Impact: Administrative access to the victim's machine Details: Rule checks for an attempt to execute remote code on a system running HP LoadRunner on port 54345 with Secure Channel disabled. Ease of Attack: Simple; Metasploit module available

What To Look For

No information provided

Known Usage

No public information

False Positives

Known false positives, with the described conditions

The application contains a "vulnerable by design" feature that allows users to execute remote code, so it is possible for legitimate traffic to also be caught by this detection.

Contributors

Cisco Talos Intelligence Group