ET EXPLOIT Possible Cisco IKEv1 Information Disclosure Vulnerability CVE-2016-6415

Query · suricata

dsize:>828;
content:"|00 00 00 00 00 00 00 00 01 10|"; offset:8; depth:10;
content:"|80 02 00|"; distance:30;
byte_test:1,<,3,0,relative;
byte_test:1,>,0,0,relative;
content:"|80 04 00 01 00 06|"; distance:1; within:6; fast_pattern;
byte_test:2,>,768,0,relative;
Raw source ET EXPLOIT Possible Cisco IKEv1 Information Disclosure Vulnerability CVE-2016-6415 · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert udp $EXTERNAL_NET any -> $HOME_NET 500 (
    msg:"ET EXPLOIT Possible Cisco IKEv1 Information Disclosure Vulnerability CVE-2016-6415";
    dsize:>828;
    content:"|00 00 00 00 00 00 00 00 01 10|"; offset:8; depth:10;
    content:"|80 02 00|"; distance:30;
    byte_test:1,<,3,0,relative;
    byte_test:1,>,0,0,relative;
    content:"|80 04 00 01 00 06|"; distance:1; within:6; fast_pattern;
    byte_test:2,>,768,0,relative;
    reference:cve,2016-6415;
    classtype:attempted-user;
    sid:2023311; rev:1;
    metadata:affected_product Cisco_PIX, attack_target Networking_Equipment, created_at 2016_09_29, cve CVE_2016_6415, deployment Datacenter, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2019_07_26, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1082, mitre_technique_name System_Information_Discovery;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.