ICCP Invalid OSI-PSEL (SCADA)

info Nessus Network Monitor Plugin ID 6256

Synopsis

The remote ICCP server has just sent an ACSE Abort Message in response to an invalid Presentation Layer Selector (PSEL) value.

Description

The remote ICCP server has just sent an ACSE Abort Message in response to an invalid Presentation Layer Selector (PSEL) value. As PSEL values are typically only 2 to 4 bytes long, this could indicate that a client is 'brute-forcing' a valid PSEL value. This sort of attack can also impact Availability to the server.

Solution

N/A

Plugin Details

Severity: Info

ID: 6256

Family: SCADA

Published: 1/6/2012

Updated: 4/29/2016