CVE-2010-3225 detection rule

alert tcp any any -> any 554 (flow:established, to_server; content:”SETUP rtsp|3a2f2f|”; offset:0; depth:13; pcre:”/^SETUP\s+rtsp\x3a\x2f\x2f/i”; pcre:”/\x0d\x0a\x0d\x0a.{8,}/sR”;)

Advertisements

About this entry