TCP: S2C Exploit Overlapping Urgent Data

This protocol anomaly triggers when it detects overlapping urgent data. While some protocols (like FTP) use the URGPTR flag in the TCP header to signal out-of-band data, it is rare to see overlapping urgent data. This can be an evasion attempt.

Extended Description

TCP datagrams containing overlapping URGENT data, or a set URGENT flag and overlapping sequence numbers constitute a protocol anomaly. The condition could indicate that a data transmission error has occurred, or that an attack involving the injection of malformed datagrams into the network is underway.

References

URL: http://www.faqs.org/rfcs/rfc1180.html

Short Name

TCP:S2C:EXPLOIT:S2C-URG-OVERLAP

Severity

Major

Recommended

False

Recommended Action

Drop Packet

TCP: S2C Exploit Overlapping Urgent Data

Extended Description

References

Found a potential security threat?