ICCP: Wrong Session Disconnect Parameter
This signature detects an inavlid Session Disconnect parameter. Several parameters, specified in ISO 8327, are constrained and not to be sent according to the ISP. Since local behavior is undefined when an unexpected parameter is encountered in the session PDU, it is possible that this could be used as a denial of service attack. The only parameter that should be present is the User Data parameter.
Short Name
SCADA:ICCP:DISCONNECT-CODE
Severity
Minor
Recommended
False
Recommended Action
None
Category
SCADA
Keywords
Disconnect Parameter Session Wrong
Release Date
03/13/2007
Supported Platforms
srx-branch-19.3
vsrx3bsd-19.2
srx-19.4
vsrx3bsd-19.4
srx-branch-19.4
vsrx-19.4
vsrx-19.2
srx-19.3
srx-branch-12.3
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx-12.3
vmx-19.3
srx-12.3
Sigpack Version
3400
False Positive
Unknown