Signature Detail

SCAN: Cybercop UDP Bomb

This signature detects attempts to scan the system using CyberCop Scanner. Attackers can be attempting to determine if the system is vulnerable to a UDP bomb denial-of-service (DoS) attack (a UDP port is flooded with ECHO and CHARGEN packets by connecting a host ECHO service to a local or remote CHARGEN service).

Extended Description

CyberCop Scanner can be used for a UDP Bomb attack. This signature detects such an attempt. A successful attack creates a denial of service condition.

References

• CVE: CVE-1999-0103
• URL: http://www.windowsitpro.com/WindowsSecurity/Article/ArticleID/9203/9203.html