Rule History

SID: 2030830 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 1 • Sep 3, 2020, 12:00 PM

Message:

ET EXPLOIT Apache2 Memory Corruption Inbound (CVE-2020-9490)

Rule:

alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET EXPLOIT Apache2 Memory Corruption Inbound (CVE-2020-9490)"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Cache-Digest|3a 20|EA"; fast_pattern; pcre:"/^(?:8=|9BQQ==)\r?\n?/R"; reference:url,bugs.chromium.org/p/project-zero/issues/detail?id=2030&q=apache&can=1; reference:cve,2020-9490; classtype:attempted-admin; sid:2030830; rev:1; metadata:created_at 2020_09_03, cve CVE_2020_9490, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_03;)

Created:

Sep 3, 2020, 12:00 PM

Updated:

Sep 3, 2020, 12:00 PM

DB Created:

Sep 3, 2020, 12:00 PM

DB Updated:

Sep 18, 2025, 8:36 PM

Filename:

rules/emerging-exploit.rules