Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER DualDesk v20 Proxy.exe long string denial of service attempt

Rule Explanation

This event is generated when an attempt to cause a denial of service to DualDesk Proxy application occurs. Impact: Attempted Denial of Service Details: Unauthenticated remote attackers can crash the DualDesk Proxy application by sending a long string to TCP ports 5500 and 5900. Ease of Attack: Simple. Proof of concept is available.

What To Look For

Known Usage

No public information

False Positives

Known false positives, with the described conditions

Very FP prone due to the fact that VNC and other servers can easily use TCP ports 5500 and 5900.

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

Rule Vulnerability

CVE Additional Information

CVE-2018-7583
Proxy.exe in DualDesk 20 allows Remote Denial Of Service (daemon crash) via a long string to TCP port 5500.
Details
Severity Base Score7.5
Impact Score3.6 Exploit Score3.9
Confidentiality ImpactNONE Integrity ImpactNONE
Availability ImpactHIGH Access Vector
Authentication Ease of Access