Bug #165

byte_jump/relative doesn't work when previous match is byte_jump.

Added by Will Metcalf almost 4 years ago. Updated almost 4 years ago.

Status:ClosedStart date:05/21/2010
Priority:NormalDue date:05/24/2010
Assignee:Gurvinder Singh% Done:

100%

Category:-Estimated time:2.50 hours
Target version:0.9.1

Description

The following sig fails to load, but is valid and should match (packet #46).

alert tcp any any -> any 445 (msg:"byte_test with byte_test + relative"; byte_jump:1,13; byte_jump:4,0,relative; content:"|48 00 00|"; within:3; sid:144; rev:1;)

[15285] 21/5/2010 -- 16:35:18 - (detect-bytejump.c:531) <Error> (DetectBytejumpSetup) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(37)] - relative bytejump match needs a previous content option
[15285] 21/5/2010 -- 16:35:18 - (detect.c:319) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(37)] - Error parsing signature "alert tcp any any -> any 445 (msg:"byte_test with byte_test + relative"; byte_jump:1,13; byte_jump:4,0,relative; content:"|48 00 00|"; within:3; sid:144; rev:1;)" from file blah.rules at line 1

Interesting that this works though.

alert tcp any any -> any 445 (msg:"byte_test with byte_test + relative"; content:"SMB"; byte_jump:1,5,relative; byte_jump:4,0,relative; content:"|48 00 00|"; within:3; sid:144; rev:1;)

rpcoversmbtraffic.pcap - rpc over smbtraffic packet 46 should cause the alert to fire. (20 KB) Will Metcalf, 05/21/2010 03:42 PM

0001-added-support-for-setting-up-bytejump-relative-when.patch Magnifier (6.04 KB) Gurvinder Singh, 05/24/2010 11:27 PM

0001-fixed-the-typo-in-byte_jump-and-host.c-Thanks-to-rm.patch Magnifier (1.22 KB) Gurvinder Singh, 05/25/2010 11:47 PM

History

#1 Updated by Gurvinder Singh almost 4 years ago

Attached patch provides the support for setting up the sig.

#2 Updated by Victor Julien almost 4 years ago

  • Status changed from Resolved to Closed
  • % Done changed from 90 to 100

Applied, thanks Gurvinder.

#3 Updated by Gurvinder Singh almost 4 years ago

There was a typo in the sig, thanks to rmkml for pointing out. Attached patch fixes this and another typo in host.c

#4 Updated by Victor Julien almost 4 years ago

Applied as well, thanks Gurvinder.

Also available in: Atom PDF