""ET EXPLOIT Suspected Exim External Auth Overflow (CVE-2023-42115)""

SID: 2048390

Revision: 1

Class Type: attempted-admin

Metadata: attack_target SMTP_Server, created_at 2023_10_03, cve CVE_2023_42115, deployment Perimeter, deployment SSLDecrypt, performance_impact Significant, confidence Low, signature_severity Major, updated_at 2023_10_03, reviewed_at 2023_10_03

Reference:

  • cve

  • 2023-42115

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: 25

Flow: established

Contents:

  • Value: "auth|20|"

Within:

PCRE: "/^(?:(?:[^A\r\n]+[A])(?:[^A\r\n]+[A])){2,}/R"

Special Options:

  • nocase

  • fast_pattern

source