Solved

Signature & CVE id for Pyloris

Posted on 2014-09-17
1
191 Views
Last Modified: 2014-10-04
https://cve.mitre.org/find/index.html   will give a CVE id for Slowloris
but not Pyloris.

Trendmicro 'approximated' that one of their IPS signature
“1003598 - Multiple HTTP Server Low Bandwidth Denial Of Service”
deals with both Slowloris & Pyloris.

I used the term 'approximated' because in Trend's signature database,
there is no equivalent CVE id for this signature while most of their
other signatures has a CVE id.

Q1:
Anyone know if Pyloris has a CVE id & what is the id?

Q2:
Does TippingPoint has a signature (or in HP's term, it's called
'Digital Vaccine') for Pyloris?   We found one for Slowloris but
not Pyloris

Q3:
As TrendMicro's host-based IPS (ie sit inside the servers) has
only one signature to deal with both Slowloris & Pyloris, can
I by the same token, reckon that TippingPoint's vaccine which
deal with Slowloris is likely to be able to deal with Pyloris by
tracking/blocking  "Low Bandwidth DoS" ?  Reason is we can't
locate any vaccine (or signature) in TippingPoint that specifically
deals with Pyloris.  TrendMicro must have run into the same
situation that they use only one signature for both threats.

I'm suspecting it's the behavior/characteristics of both
Pyloris & Slowloris not to take up much bandwidth that
they have a common signature for TrendMicro's IPS
0
Comment
Question by:sunhux
1 Comment
 
LVL 61

Accepted Solution

by:
gheist earned 500 total points
Comment Utility
CVE records vulnerabilieties, not exploits.
You can write same in shell script if you want, not python.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
Read about achieving the basic levels of HRIS security in the workplace.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now