SID 1:51000

Rule Category

PROTOCOL-DNS -- Snort alerted on a Domain Name Server (DNS) protocol issue. These packets travel over UDP on port 53 to serve DNS queries--user website requests through a browser. Several vulnerability use-cases exist (ie, additional data could be sent with a request, which would contact a DNS server pre-prepared to send information back and forth).

Alert Message

PROTOCOL-DNS PowerDNS Recursor query denial of service attempt

Rule Explanation

This event is generated when a PowerDNS Recursor query containing an out-of-bounds read is sent, causing a DoS Impact: Attempted Denial of Service Details: Ease of Attack:

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group