Rule Document 1:66887

Rule Category

FILE-OTHER -- Snort detected traffic targeting vulnerabilities in a file type that does not require enough rule coverage to have its own category.

Alert Message

FILE-OTHER 7-Zip 7Z file parsing integer underflow attempt

Rule Explanation

This rule looks for a 7‑Zip archive header followed by a PPMd codec descriptor that specifies an invalid zero order value. Successful exploitation may allow an attacker to achieve memory corruption leading to arbitrary code execution.

What To Look For

This rule fires on attempts to exploit an integer underflow vulnerability in 7‑Zip archive files.

Known Usage

Public information/Proof of Concept available

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group