Rule History

SID: 2017557 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 6 • Oct 4, 2013, 12:00 PM

Message:

ET EXPLOIT Possible Java CVE-2013-1488 java.sql.Drivers Service Object in JAR

Rule:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Java CVE-2013-1488 java.sql.Drivers Service Object in JAR"; flow:established,from_server; flowbits:isset,ET.http.javaclient; file_data; content:"META-INF/services/java.sql.Drivers"; fast_pattern; content:"META-INF/services/java.lang.Object"; reference:cve,2013-1488; reference:url,www.contextis.com/research/blog/java-pwn2own/; reference:url,www.rapid7.com/db/modules/exploit/multi/browser/java_jre17_driver_manager; classtype:attempted-user; sid:2017557; rev:6; metadata:created_at 2013_10_04, confidence Medium, signature_severity Major, updated_at 2022_07_14;)

Created:

Oct 4, 2013, 12:00 PM

Updated:

Jul 14, 2022, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-exploit.rules