How to create custom vulnerability signature for SIP packets?

lzolotonos — Thu, 01 Aug 2013 14:04:38 GMT

Hi,

we are trying to create custom vulnerability signature for triggering on the specific string in the udp packet payload with destination port 5060. Unfortunately there is no context for SIP. We used "Pattern Match" and chose "unknown -req-udp-payload" as a context. We applied a Vulnerability protection profile to the security policy (a rule allowing everything) but for some reason this didn't work as we expected. I mean we didn't receive any alert in the Threat log.

Is it possible to use "unknown -req-udp-payload" context for such purpose or it is intended only for the "unknown-udp" applications? Any other idea for creating such signature?

Thanks.

Leonid

Re: How to create custom vulnerability signature for SIP packets?

jvalentine — Thu, 01 Aug 2013 15:25:50 GMT

You'll need to contact TAC and ask for them to open up SIP contexts in custom vulnerability signatures. This is something that can be done through a content update. The "unknown" contexts you refer to are only applicable to "unknown-tcp" and "unknown-udp" App-IDs.

topic How to create custom vulnerability signature for SIP packets? in Automation/API Discussions

How to create custom vulnerability signature for SIP packets?

Re: How to create custom vulnerability signature for SIP packets?