Configure Vulnerability Rules

Last updated
Save as PDF

To configure vulnerability rules, upload a file containing vulnerability rules from the local system:

Go to Configure > Security Service Edge > Real-Time Protection > Profiles.
Select the Secure Web Gateway tab, and then select the Vulnerabilities tab.
Select Upload File. The Upload File popup window displays.
Enter a file name in the File Name field, or click Browse to search for a file.
Click Upload.

Below is an example of the contents of a vulnerability rule file:

alert tcp $HOME_NET any -> $EXTERNAL_NET 110 (msg:"cURL and libcurl MD5 Digest Buffer Overflow"; flow:to_server; content:"CAPA"; flowbits:set, fb_50000064; reference:tsl,TSL20130207-03; reference:cve,CVE-2013-0249; reference:osvdb,89988; reference:secunia,SA52103; sid:50000064; )
alert tcp $EXTERNAL_NET 110 -> $HOME_NET any (msg:"cURL and libcurl MD5 Digest Buffer Overflow"; flow:from_server; flowbits: isset, fb_50000064; content:"+OK"; content:"SASL"; content:"DIGEST-MD5"; flowbits:set, fb_50000065; reference:tsl,TSL20130207-03; reference:cve,CVE-2013-0249; reference:osvdb,89988; reference:secunia,SA52103; sid:50000065; metadata: flowbit_src: fb_50000064;)
alert tcp $HOME_NET any -> $EXTERNAL_NET 110 (msg:"cURL and libcurl MD5 Digest Buffer Overflow"; flow:to_server; flowbits: isset, fb_50000065; content:"AUTH DIGEST-MD5"; offset:0; depth:15;flowbits:set, fb_50000066; reference:tsl,TSL20130207-03; reference:cve,CVE-2013-0249; reference:osvdb,89988; reference:secunia,SA52103; sid:50000066; metadata: flowbit_src: fb_50000065;)
alert tcp $EXTERNAL_NET 110 -> $HOME_NET any (msg:"cURL and libcurl MD5 Digest Buffer Overflow"; flow:from_server; flowbits:isset, fb_50000066; pcre:"/\+\s*/s"; base64_decode:relative;base64_data; pcre:"/algorithm\s*?=\s*?md5-sess/s"; pcre:"/nonce\s*?=/s"; pcre:"/realm\s*?=\s*?(\"|\')/s"; isdataat:124,relative; content:!"|22|"; distance:0; within:124; reference:tsl,TSL20130207-03; reference:cve,CVE-2013-0249; reference:osvdb,89988; reference:secunia,SA52103; sid:1000000372; metadata: flowbit_src: fb_50000066;)