Re: Help to detect CVE-2019-11479
Matt Trostel <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
Hi Zer0d0y, You should be able to pull these values from the connection_SYN_packet event (https://docs.zeek.org/en/stable/script-reference/proto-analyzers.html#id-connection_SYN_packet <https://docs.zeek.org/en/stable/script-reference/proto-analyzers.html#id-connection_SYN_packet>). The SYN packet (https://docs.zeek.org/en/stable/scripts/base/init-bare.bro.html#type-SYN_packet <https://docs.zeek.org/en/stable/scripts/base/init-bare.bro.html#type-SYN_packet>) contains the MSS value. I hope this helps. - Matt > On Jul 1, 2019, at 10:19, Zer0d0y <[email protected]> wrote: > > Hi all, > Recently,Netflix has identified several TCP networking vulnerabilities in FreeBSD and Linux kernels. (#CVE-2019-11479 : Excess Resource Consumption Due to Low MSS Values (all Linux versions) > > We want to detecting this flaw with Zeek,but looks like there's no way to get the MSS(Maximum segment size) value of TCP Option,any ideas? > > Thanks, > > ------------------ > > Zer0d0y > Threat Detection & Hunting > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek