""ET ATTACK_RESPONSE Possible CVE-2021-44228 Payload via LDAPv3 Response""

SID: 2034722

Revision: 1

Class Type: attempted-admin

Metadata: attack_target Client_and_Server, created_at 2021_12_14, cve CVE_2021_44228, deployment Perimeter, signature_severity Major, updated_at 2021_12_14

Reference:

  • cve

  • 2021-44228

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "|30 81|" Depth: 2

  • Value: "|02 01|"

  • Value: "|64|"

  • Value: "|04|"

  • Value: "|04 0d|javaClassName"

  • Value: "|04|"

  • Value: "|04 0c|javaCodeBase"

  • Value: "|04|"

  • Value: "|04 0b|objectClass"

  • Value: "|04|"

  • Value: "|04 0b|javaFactory"

Within: 18

PCRE:

Special Options:

  • fast_pattern

source