HTTP: Suspicious Random URI And GET Parameter

This signature detects a suspicious HTTP URL. This kind of behavior is mostly observed when someone is trying to scan and send malicious traffic against a network security device using various traffic generation tools. This signature may trigger false-positives inside the Intranet traffic, so it is suggested to avoid using it for inspecting such traffic. This signature is highly recommended to protect web servers and devices deployed at a data centre.

Extended Description

HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.

Affected Products

Haproxy haproxy

References

CVE: CVE-2016-5360

URL: http://www.openwall.com/lists/oss-security/2016/06/09/5

Short Name

HTTP:DOS:URI-PARAM-RANDOM

Severity

Major

Recommended

False

Recommended Action

None

HTTP: Suspicious Random URI And GET Parameter

Extended Description

Affected Products

References

Found a potential security threat?