CVE-2020-16898

"Bad Neighbor" Detection, CVE-2020-16898 (Windows TCP/IP RCE)

Summary:

A network detection package for CVE-2020-16898 (Windows TCP/IP Remote Code Execution Vulnerability)

References:

  • https://corelight.blog/2020/10/15/zeek-community-activates-to-detect-bad-neighbor-cve-2020-16898/
  • https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-16898#ID0EUGAC
  • Other detection packages developed independently and concurrently by the Zeek community: https://github.com/initconf/CVE-2020-16898-Bad-Neighbor/blob/master/scripts/CVE-2020-16898-Bad-Neighbor.zeek
    https://github.com/esnet-security/cve-2020-16898

Notices raised :

CVE-2020-16898 exploit detected from %s. https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-16898#ID0EUGAC . Details from packet for reference: info=%s , options=%s

Usage, notes and recommendations:

  • To use against a pcap you already have zeek -Cr scripts/__load__.zeek your.pcap
  • This package will run in clustered or non clustered environments.

Feedback

  • As details emerge, we are keen to improve this package for the benefit of the community, please feel free to contact the author with any suggestions and feedback.

Package Version :