Intrusion Prevention

ICCP.Invalid.OSI.PSEL.Abort.PDU

Description

The OSI Connection Oriented Transport Protocol (COTP) is used by ICCP to establish sessions and exchange connection parameters. An ICCP Server has sent a ACSE Abort Message message in response to an invalid Presentation Layer Selector (PSEL) received from the client. An attacker might be trying to brute force the PSEL in order to send valid MMS/ICCP messages.

Affected Products

ICCP servers and MMS-based applications.

Impact

System compromise.

Recommended Actions

Investigate the source of the traffic to prevent further attacks.