ET EXPLOIT Zoom Linux Client Command Injection (CVE-2017-15049)

Query · suricata

flow:established,to_client;
file.data;
content:"zoommtg|3a 2f 2f|";
pcre:"/^[^\x22\x27]*?[\x3b\x26\x60\x7c\x24]/R";
target:dest_ip;
Raw source ET EXPLOIT Zoom Linux Client Command Injection (CVE-2017-15049) · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tcp any any -> $HOME_NET any (
    msg:"ET EXPLOIT Zoom Linux Client Command Injection (CVE-2017-15049)";
    flow:established,to_client;
    file.data;
    content:"zoommtg|3a 2f 2f|";
    pcre:"/^[^\x22\x27]*?[\x3b\x26\x60\x7c\x24]/R";
    reference:url,packetstorm.news/files/id/145453;
    reference:cve,2017-15049;
    classtype:bad-unknown;
    sid:2066200; rev:1;
    metadata:affected_product Zoom, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2025_12_09, cve CVE_2017_15049, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, updated_at 2025_12_09;
    target:dest_ip;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.