Project

General

Profile

Actions
Copy link

Bug #134

closed
RR GS

suricata content+depth+offset pb (FalseNegative)

Bug #134: suricata content+depth+offset pb (FalseNegative)

Added by rmkml rmkml almost 16 years ago. Updated almost 16 years ago.

Status:
Closed
Priority:
High
Assignee:
Gurvinder Singh
Target version:
0.9.0
Affected Versions:
Effort:
Difficulty:
Label:

Description

Hi,
I have downloaded latest suricata git version (v0.8.2 release have same pb), look my simply signature/rule:
alert tcp any any -> any 515 (msg:"detect IFS"; flow:to_server,established; content:"${IFS}"; depth:50; offset:0; classtype:attempted-dos; sid:900091; rev:1; )
Joigned pcap file (old lpd exploit) demonstrate the pb.
I have removed offset keyword on my signature/rule and alert firing!:
If anyone have a idea please?
Regards
Rmkml

Files

Download all files
exploit_hpux_lpd_exec.pcap (17.1 KB) exploit_hpux_lpd_exec.pcap rmkml rmkml, 04/29/2010 08:02 AM
0001-fixed-the-incorrect-depth-update-incase-of-offset-is.patch (1.66 KB) 0001-fixed-the-incorrect-depth-update-incase-of-offset-is.patch Gurvinder Singh, 05/02/2010 12:13 AM

VJ Updated by Victor Julien almost 16 years ago Actions
Copy link
 #1

  • Due date set to 05/01/2010
  • Assignee set to Pablo Rincon
  • Priority changed from Normal to High
  • Target version set to 0.9.0
  • Estimated time set to 3.00 h

GS Updated by Gurvinder Singh almost 16 years ago Actions
Copy link
 #2

The bug was caused by incorrect updation of depth length when offset is 0. Attached patch fix the bug. Again thanks Rmkml for pointing out :-)

VJ Updated by Victor Julien almost 16 years ago Actions
Copy link
 #3

  • Status changed from Resolved to Closed
  • % Done changed from 0 to 100

I've applied the patch. Did a small modification of it. It now only updates cd->depth if depth != 0 and smaller than content_len + offset.

Actions
Copy link

Also available in: PDF Atom