Bug #167

asn1 keyword needs to be able to support negative values for relative offsets.

Added by Will Metcalf almost 4 years ago. Updated almost 4 years ago.

Status:ClosedStart date:05/26/2010
Priority:NormalDue date:06/04/2010
Assignee:Pablo Rincon% Done:

100%

Category:-Estimated time:2.50 hours
Target version:0.9.2

Description

asn1 keyword needs to be able to support negative values for relative offsets. See sids 2578 and 2579 in the VRT exploit.rules for example usage. Below is the error given by suricata when trying to use a value of -1 i.e. move the cursor to be one byte previous to the last match.

[23964] 26/5/2010 -- 06:51:06 - (util-byte.c:167) <Error> (ByteExtractStringUint32) -- [ERRCODE: SC_ERR_NUMERIC_VALUE_ERANGE(59)] - Numeric value out of range (ffffffff != ffffffffffffffff)
[23964] 26/5/2010 -- 06:51:06 - (detect-asn1.c:250) <Error> (DetectAsn1Parse) -- [ERRCODE: SC_ERR_INVALID_VALUE(126)] - Malformed value for relative_offset: 1
[23964] 26/5/2010 -
06:51:06 - (detect.c:321) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(37)] - Error parsing signature "VRT RULE HERE" from file /etc/suricata/exploit.rules at line 90
[23964] 26/5/2010 -- 06:51:06 - (util-byte.c:167) <Error> (ByteExtractStringUint32) -- [ERRCODE: SC_ERR_NUMERIC_VALUE_ERANGE(59)] - Numeric value out of range (ffffffff != ffffffffffffffff)
[23964] 26/5/2010 -- 06:51:06 - (detect-asn1.c:250) <Error> (DetectAsn1Parse) -- [ERRCODE: SC_ERR_INVALID_VALUE(126)] - Malformed value for relative_offset: 1
[23964] 26/5/2010 -
06:51:06 - (detect.c:321) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(37)] - Error parsing signature "VRT RULE HERE" from file /etc/suricata/exploit.rules at line 91

0001-Fixing-asn1-relative-offset-negative-values.patch Magnifier - support negative values for relative offsets at asn1 keyword (5.32 KB) Pablo Rincon, 06/01/2010 04:25 PM

History

#1 Updated by Victor Julien almost 4 years ago

  • Due date changed from 06/10/2010 to 06/04/2010
  • Assignee changed from OISF Dev to Pablo Rincon

#2 Updated by Pablo Rincon almost 4 years ago

Hi, after reviewing snorts code, it seems that only the relative offset value will take effect with a negative value. It seems that a negative value for absolute offsets doesn't make sense, because it will always be out of bounds. So I implemented it only for relative values, ignoring the definition at the documentation regarding to negative values for absolute offsets.

#3 Updated by Victor Julien almost 4 years ago

  • Status changed from Assigned to Closed
  • % Done changed from 0 to 100

Applied, thanks Pablo.

Also available in: Atom PDF