huntrule

Linux sshd Buffer Parsing Error Indicative of CVE-2018-15473 Exploit Attempts

Flags Linux sshd pre-auth buffer parsing error messages that align with CVE-2018-15473 exploit attempts.

FreeUnreviewedSigmamediumv1
title: Linux sshd Buffer Parsing Error Indicative of CVE-2018-15473 Exploit Attempts
id: 25461ba2-54e6-4227-82b7-3eaeecc07432
status: test
description: This rule matches specific sshd error text indicating a pre-auth buffer parsing failure consistent with an exploitation attempt for CVE-2018-15473. Attackers may trigger malformed input during the SSH handshake to reach vulnerable code paths and elicit identifiable error output. The detection relies on Linux sshd log messages containing the exact error keyword string.
references:
  - https://github.com/Rhynorater/CVE-2018-15473-Exploit
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Exploits/CVE-2018-15473/lnx_sshd_exploit_cve_2018_15473.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-08-24
modified: 2021-11-27
tags:
  - attack.reconnaissance
  - attack.t1589
  - cve.2018-15473
  - detection.emerging-threats
logsource:
  product: linux
  service: sshd
detection:
  keywords:
    - "error: buffer_get_ret: trying to get more bytes 1907 than in buffer 308 [preauth]"
  condition: keywords
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4c9d903d-4939-4094-ade0-3cb748f4d7da
    type: derived

What it detects

This rule matches specific sshd error text indicating a pre-auth buffer parsing failure consistent with an exploitation attempt for CVE-2018-15473. Attackers may trigger malformed input during the SSH handshake to reach vulnerable code paths and elicit identifiable error output. The detection relies on Linux sshd log messages containing the exact error keyword string.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.