Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
CVE coverage

CVE-2002-1561

CVSS 5.0 20 detections found
View on NVD →
The RPC component in Windows 2000, Windows NT 4.0, and Windows XP allows remote attackers to cause a denial of service (disabled RPC service) via a malformed packet to the RPC Endpoint Mapper at TCP port 135, which triggers a null pointer dereference.

Detection rules

Source Rule Status Updated
suricata GPL NETBIOS SMB IrotIsRunning attempt rev 5 2019-07-26
suricata GPL NETBIOS SMB IrotIsRunning little endian attempt rev 5 2019-07-26
suricata GPL NETBIOS SMB IrotIsRunning unicode attempt rev 5 2019-07-26
suricata GPL NETBIOS SMB IrotIsRunning unicode little endian attempt rev 5 2019-07-26
suricata GPL NETBIOS SMB-DS IrotIsRunning attempt rev 5 2019-07-26
suricata GPL NETBIOS SMB-DS IrotIsRunning little endian attempt rev 5 2019-07-26
suricata GPL NETBIOS SMB-DS IrotIsRunning unicode attempt rev 6 2019-07-26
suricata GPL NETBIOS SMB-DS IrotIsRunning unicode little endian attempt rev 5 2019-07-26
suricata GPL NETBIOS DCERPC IrotIsRunning attempt rev 4 2019-07-26
suricata GPL NETBIOS DCERPC IrotIsRunning little endian attempt rev 4 2019-07-26
snort GPL NETBIOS DCERPC IrotIsRunning little endian attempt rev 4 2011-11-30
snort GPL NETBIOS DCERPC IrotIsRunning attempt rev 4 2011-11-30
snort GPL NETBIOS SMB IrotIsRunning unicode attempt rev 5 2011-09-20
snort GPL NETBIOS SMB IrotIsRunning unicode little endian attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS IrotIsRunning attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS IrotIsRunning little endian attempt rev 5 2011-09-20
snort GPL NETBIOS SMB-DS IrotIsRunning unicode attempt rev 6 2011-09-20
snort GPL NETBIOS SMB-DS IrotIsRunning unicode little endian attempt rev 5 2011-09-20
snort GPL NETBIOS SMB IrotIsRunning attempt rev 5 2011-09-20
snort GPL NETBIOS SMB IrotIsRunning little endian attempt rev 5 2011-09-20