Sid 1-52042

Rule Documentation
References

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER OpenSSL ECDH malformed Client Hello denial of service attempt

Rule Explanation

This event is generated when an attacker attempts to exploit a denial of service vulnerability in OpenSSL. Impact: Detection of a Denial of Service Attack Details: This rule checks for attempts to exploit a denial of service vulnerability in OpenSSL. Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

CVE-2011-3210

Rule Vulnerability

CVE Additional Information

CVE-2011-3210

The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

Details
Severity	MEDIUM	Base Score	5.0
Impact Score	2.9	Exploit Score	10.0
Confidentiality Impact	NONE	Integrity Impact	NONE
Availability Impact	PARTIAL	Access Vector	NETWORK
Authentication	NONE	Ease of Access	LOW