SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.
SERVER-OTHER Microsoft Exchange Server 2010 deserialization attempt
Microsoft's Exchange 2010 Server suffers from a deserialization vulnerability via it's Exchange Web Services (EWS) SOAP API. Using a valid user account an attacker is able to upload a malicious serialized binary that would allow for remote code execution on the server.
What To Look For
This rule alerts when an attempt to trigger an deserialization vulnerability on a Microsoft's Exchange 2010 server.
No public information
No known false positives
Cisco Talos Intelligence Group
MITRE ATT&CK Framework
Technique: User Execution
For reference, see the MITRE ATT&CK vulnerability types here:
Memory Corruption is any vulnerability that allows the modification of the content of memory locations in a way not intended by the developer. Memory corruption results are inconsistent; they could lead to fatal errors and system crashes or data leakage; some have no effect at all.
CVE Additional Information