Sid 1-51357

Rule Documentation
References

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER OpenSSL DTLS duplicate record denial of service attempt

Rule Explanation

This event is generated when traffic that can trigger the vulnerability outlined in CVE--2015-0206 is detected. Impact: Denial of Service Details: Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

CVE-2015-0206

Rule Vulnerability

CVE Additional Information

CVE-2015-0206

Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection.

Details
Severity	MEDIUM	Base Score	5.0
Impact Score	2.9	Exploit Score	10.0
Confidentiality Impact	NONE	Integrity Impact	NONE
Availability Impact	PARTIAL	Access Vector
Authentication	NONE	Ease of Access