Signature Detail
Short Name |
SCADA:ICCP:DISCONNECT-CODE |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
SCADA |
Release Date |
2007/03/13 |
Update Number |
1213 |
Supported Platforms |
idp-4.1+, isg-3.5+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
ICCP: Wrong Session Disconnect Parameter
This signature detects an inavlid Session Disconnect parameter. Several parameters, specified in ISO 8327, are constrained and not to be sent according to the ISP. Since local behavior is undefined when an unexpected parameter is encountered in the session PDU, it is possible that this could be used as a denial of service attack. The only parameter that should be present is the User Data parameter.
References