Skip to content

Instantly share code, notes, and snippets.

@kraigu

kraigu/cve2020-1350.zeek

Created July 16, 2020 19:18
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save kraigu/8949979f209fe6a7430dceafce0d1a78 to your computer and use it in GitHub Desktop.
Save kraigu/8949979f209fe6a7430dceafce0d1a78 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
cve2020-1350.zeek
module CVE_2020_1350;
export
{
redef enum Notice::Type += {
CVE_2020_1350
};
}
event dns_unknown_reply(c: connection, msg: dns_msg, ans: dns_answer)
{
if ( ans$qtype==24 && c$resp$size > 65000 )
{
NOTICE([$note=CVE_2020_1350, $conn=c, $msg="Potential CVE-2020-1350 exploit detected", $identifier=cat(c$id$orig_h)]);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment