Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible Java CVE-2013-2465 Based on PoC"; flow:established,from_server; flowbits:isset,ET.http.javaclient; file_data; content:"$MyColorModel.class"; content:"$MyColorSpace.class"; reference:cve,2013-2465; reference:url,seclists.org/fulldisclosure/2013/Aug/134; reference:url,malwageddon.blogspot.com/2013/10/unknown-ek-i-wanna-be-billionaire-so.html; classtype:exploit-kit; sid:2017563; rev:4; metadata:created_at 2013_10_08, signature_severity Unknown, tag CISA_KEV, updated_at 2022_06_28;)