huntrule

sshd Buffer Underflow Error Message Matching CVE-2018-15473 Exploit Attempt (Linux)

Flags Linux sshd pre-auth buffer parsing error messages that align with CVE-2018-15473 exploit attempts.

FreeReviewedSigma · Medium · v5
Product
linux
Service
sshd
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2017-08-24
Updated
2026-07-31
AnalysisDetection
title: sshd Buffer Underflow Error Message Matching CVE-2018-15473 Exploit Attempt (Linux)
id: 25461ba2-54e6-4227-82b7-3eaeecc07432
status: test
description: This rule flags SSH daemon log entries containing a specific pre-auth error message indicating a buffer length mismatch. Attackers may trigger this condition while attempting to exploit CVE-2018-15473, using crafted input to cause malformed parsing behavior. It relies on Linux sshd service logs and matches the presence of the exact error string in log messages.
references:
  - https://github.com/Rhynorater/CVE-2018-15473-Exploit
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Exploits/CVE-2018-15473/lnx_sshd_exploit_cve_2018_15473.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-08-24
modified: 2021-11-27
tags:
  - attack.reconnaissance
  - attack.t1589
  - cve.2018-15473
  - detection.emerging-threats
logsource:
  product: linux
  service: sshd
detection:
  keywords:
    - "error: buffer_get_ret: trying to get more bytes 1907 than in buffer 308 [preauth]"
  condition: keywords
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4c9d903d-4939-4094-ade0-3cb748f4d7da
    type: derived