ET EXPLOIT VMWare ESXi 6.7.0 OpenSLP Remote Code Execution Attempt - Directory Agent Advertisement Heap Overflow (CVE-2021-21974)
Sourceet/open
CreatedFebruary 3, 2023
UpdatedFebruary 3, 2023
Classificationattempted-admin
alert tcp any any -> $HOME_NET 427 (msg:"ET EXPLOIT VMWare ESXi 6.7.0 OpenSLP Remote Code Execution Attempt - Directory Agent Advertisement Heap Overflow (CVE-2021-21974)"; flow:established,to_server; dsize:>280; content:"|02 08|"; startswith; byte_jump:2,19,relative,little; byte_test:2,>=,256,0,relative; content:"|01|:/"; reference:url,straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9; reference:cve,2021-21974; classtype:attempted-admin; sid:2044114; rev:1; metadata:affected_product VMware, attack_target Server, created_at 2023_02_03, cve CVE_2021_21974, deployment Perimeter, deployment Internal, deployment Datacenter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_02_03, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
References
Metadata
affected productVMware
attack targetServer
created at2023_02_03
deploymentDatacenter
performance impactLow
confidenceHigh
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2023_02_03
mitre tactic idTA0001
mitre tactic nameInitial_Access
mitre technique idT1190
mitre technique nameExploit_Public_Facing_Application
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!