cve-2020-1350.zeek

##! DNS Detections
##! Developed for Critical Path Security by Patrick Kelley
##! 2020-07-16
##! www.criticalpathsecurity.com

##! Identifier="2020-07-16"
##! Iteration="1.0"
##! Description="Detects CVE-2020-1350"
##! Protocol="DNS"
##! CreationDate="2020-07-16"
##! LastUpdate="2020-07-16"

module CVE_2020_1350;

export {
        redef enum Notice::Type += {
                CVE_2020_1350
        };


event dns_unknown_reply(c: connection, msg: dns_msg, ans: dns_answer) {
      if ( c$resp$size > 65000 && ans$qtype==24) {
      NOTICE([$note=CVE_2020_1350,
      $conn=c,
      $msg=fmt("%s is attempting to exploit %s using CVE-2020-1350. query is %s.", c$id$orig_h, c$id$resp_h, ans),
      $sub=fmt("Severity: 9"),
      $identifier=cat(c$id$orig_h)]);
    }
  }
}