Skip to content

Instantly share code, notes, and snippets.

@Serphentas

Serphentas/CVE-2018-0101.rules

Forked from fox-srt/CVE-2018-0101.rules
Created February 1, 2018 18:24
Show Gist options
  • Save Serphentas/e3d1b2a630ea8c72b0165a69b01c47ea to your computer and use it in GitHub Desktop.
Save Serphentas/e3d1b2a630ea8c72b0165a69b01c47ea to your computer and use it in GitHub Desktop.
Download ZIP
Cisco ASA RCE / CVE-2018-0101 IDS Signatures
Raw
CVE-2018-0101.rules
# IDS signatures for https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1:
alert udp any any -> any 500 (msg:"FOX-SRT - Suspicious - Possible Fragmented Cisco IKE/isakmp Packet HeapSpray (CVE-2018-0101)"; flow:to_server; content:"|84|"; offset:16; depth:1; content:"|02 08 |"; distance:1; within:2; fast_pattern; byte_test:4,>,5000,4,relative; byte_test:2,>,5000,10,relative; byte_extract:4,36,fragment_match; byte_test:4,=,fragment_match,52,relative; byte_test:4,=,fragment_match,136,relative; byte_test:4,=,fragment_match,236,relative; threshold:type limit, track by_dst, count 1, seconds 600; classtype:attempted-admin; sid:21002339; rev:4;)
alert udp any any -> any 500 (msg:"FOX-SRT - Exploit - Possible Shellcode in Cisco IKE/isakmp - tcp/CONNECT/"; content:"tcp/CONNECT/"; fast_pattern:only; threshold:type limit, track by_src, count 1, seconds 600; priority:1; classtype:attempted-admin; sid:21002340; rev:2;)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment