CVE-2004-0367

## Snort IDS/IPS Mitigation Rules (3 rules) The following Emerging Threats Snort rules detect exploitation of this vulnerability: ### Rule 1: SID 2102464 (rev 8) **GPL EXPLOIT EIGRP prefix length overflow attempt** > **Note:** This rule is currently disabled in the Emerging Threats ruleset. ```snort #alert ip any any -> any any (msg:"GPL EXPLOIT EIGRP prefix length overflow attempt"; ip_proto:88; byte_test:1,>,32,44; reference:bugtraq,9952; reference:cve,2004-0176; reference:cve,2004-0367; classtype:attempted-admin; sid:2102464; rev:8; metadata:created_at 2010_09_23, confidence Medium, signature_severity Major, updated_at 2012_07_27;) ``` --- ### Rule 2: SID 2102462 (rev 8) **GPL EXPLOIT IGMP IGAP account overflow attempt** > **Note:** This rule is currently disabled in the Emerging Threats ruleset. ```snort #alert ip any any -> any any (msg:"GPL EXPLOIT IGMP IGAP account overflow attempt"; ip_proto:2; byte_test:1,>,63,0; byte_test:1,<,67,0; byte_test:1,>,16,12; reference:bugtraq,9952; reference:cve,2004-0176; reference:cve,2004-0367; classtype:attempted-admin; sid:2102462; rev:8; metadata:created_at 2010_09_23, confidence Medium, signature_severity Major, updated_at 2012_07_27;) ``` --- ### Rule 3: SID 2102463 (rev 8) **GPL EXPLOIT IGMP IGAP message overflow attempt** > **Note:** This rule is currently disabled in the Emerging Threats ruleset. ```snort #alert ip any any -> any any (msg:"GPL EXPLOIT IGMP IGAP message overflow attempt"; ip_proto:2; byte_test:1,>,63,0; byte_test:1,<,67,0; byte_test:1,>,64,13; reference:bugtraq,9952; reference:cve,2004-0176; reference:cve,2004-0367; classtype:attempted-admin; sid:2102463; rev:8; metadata:created_at 2010_09_23, confidence Medium, signature_severity Major, updated_at 2012_07_27;) ``` ### Implementation Steps 1. Deploy these rules to your Snort/Suricata IDS/IPS sensors 2. Ensure all rules are enabled in your sensor configuration 3. Monitor for alerts matching the above SIDs 4. For IPS mode, consider changing action from `alert` to `drop`

EPSS 9.21% · 92.9th percentile