SID 1:51018

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER DualDesk v20 Proxy.exe long string denial of service attempt

Rule Explanation

This event is generated when an attempt to cause a denial of service to DualDesk Proxy application occurs. Impact: Attempted Denial of Service Details: Unauthenticated remote attackers can crash the DualDesk Proxy application by sending a long string to TCP ports 5500 and 5900. Ease of Attack: Simple. Proof of concept is available.

What To Look For

No information provided

Known Usage

No public information

False Positives

Known false positives, with the described conditions

Very FP prone due to the fact that VNC and other servers can easily use TCP ports 5500 and 5900.

Contributors

Cisco Talos Intelligence Group