Signature Detail

TCP: S2C Exploit Overlapping Urgent Data

This protocol anomaly triggers when it detects overlapping urgent data. While some protocols (like FTP) use the URGPTR flag in the TCP header to signal out-of-band data, it is rare to see overlapping urgent data. This can be an evasion attempt.

Extended Description

TCP datagrams containing overlapping URGENT data, or a set URGENT flag and overlapping sequence numbers constitute a protocol anomaly. The condition could indicate that a data transmission error has occurred, or that an attack involving the injection of malformed datagrams into the network is underway.

References

• URL: http://www.faqs.org/rfcs/rfc1180.html