""ET EXPLOIT Ghostscript illegal read undefinedfilename attempt (SMTP)""

SID: 2026086

Revision: 1

Class Type: attempted-user

Metadata: attack_target SMTP_Server, created_at 2018_09_05, deployment Datacenter, signature_severity Informational, updated_at 2018_09_05

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $SMTP_SERVERS

Destination Port: 25

Flow: to_server,established

Contents:

  • Value: "undefinedfilename"

  • Value: "errordict"

  • Value: "invalidfileaccess"

  • Value: "typecheck"

Within:

PCRE: "/errordict\s+\x2Finvalidfileaccess/smi"

Special Options:

  • file_data

  • fast_pattern

source