Actions
Bug #5242
closedBug #5220: fast_pattern specification in base64_data shouldn't be allowed
fast_pattern specification in base64_data shouldn't be allowed (6.0.x backport)
Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:
Description
It seems that specifying a fast_pattern in base64_data is ignored both from an error/warning standpoint and from an actual fast_pattern assignment by suricata. It seems suricata should warn/fail on fast_pattern assignment in base64_data.
rule example:
alert http $HOME_NET any -> $EXTERNAL_NET any (flow:established,to_server; http.method; content:"POST"; http.request_body; base64_decode:bytes 28; base64_data; content:"something"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;)
suricata.log:
[52155] 29/3/2022 -- 20:20:41 - (detect-engine-loader.c:354) <Info> (SigLoadSignatures) -- 1 rule files processed. 1 rules successfully loaded, 0 rules failed
rules_fast_pattern.log:
== Sid: 123 == alert http $HOME_NET any -> $EXTERNAL_NET any (flow:established,to_server; http.method; content:"POST"; http.request_body; base64_decode:bytes 28; base64_data; content:"something"; fast_pattern; classtype:bad-unknown; sid:123; rev:1;) Fast Pattern analysis: Fast pattern matcher: http request method (http_method) Flags: None Fast pattern set: no Fast pattern only set: no Fast pattern chop set: no Original content: POST Final content: POST
suricata version:
This is Suricata version 7.0.0-dev (99b344336 2022-03-25)
Updated by Jeff Lucovsky over 2 years ago
- Copied from Bug #5220: fast_pattern specification in base64_data shouldn't be allowed added
Updated by Victor Julien over 2 years ago
- Target version changed from 6.0.6 to 6.0.7
Updated by Victor Julien about 2 years ago
- Target version changed from 6.0.7 to 6.0.8
Updated by Victor Julien about 2 years ago
- Target version changed from 6.0.8 to 6.0.9
Updated by Shivani Bhardwaj almost 2 years ago
- Status changed from New to Rejected
Updated by Shivani Bhardwaj almost 2 years ago
- Status changed from Rejected to New
- Parent task set to #5220
Updated by Victor Julien almost 2 years ago
- Subject changed from fast_pattern specification in base64_data shouldn't be allowed to fast_pattern specification in base64_data shouldn't be allowed (6.0.x backport)
Updated by Victor Julien almost 2 years ago
- Target version changed from 6.0.9 to 6.0.10
Updated by Victor Julien almost 2 years ago
- Target version changed from 6.0.10 to 6.0.11
Updated by Victor Julien over 1 year ago
- Target version changed from 6.0.11 to 6.0.12
Updated by Victor Julien over 1 year ago
- Target version changed from 6.0.12 to 6.0.13
Updated by Victor Julien over 1 year ago
- Target version changed from 6.0.13 to 6.0.14
Updated by Victor Julien about 1 year ago
- Target version changed from 6.0.14 to 6.0.15
Updated by Victor Julien 12 months ago
- Target version changed from 6.0.15 to 6.0.16
Updated by Victor Julien 9 months ago
- Target version changed from 6.0.16 to 6.0.17
Updated by Victor Julien 9 months ago
- Status changed from New to Rejected
- Assignee deleted (
OISF Dev) - Target version deleted (
6.0.17)
Rejecting as 6.0.x is now in extended support and EOL in 6 months.
Actions