Project

General

Profile

Actions
Copy link

Bug #5770

closed
PA PA

smb: no consistency check between NBSS length and length field for some SMB operations

Bug #5770: smb: no consistency check between NBSS length and length field for some SMB operations

Added by Philippe Antoine over 3 years ago. Updated about 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
7.0.0-rc2
Affected Versions:
Effort:
Difficulty:
Label:

Description

For instance for SMB2 write request, the Length field indicates the length of the buffer contained in the NBSS record
But Suricata takes into account this length independently of the NBSS length for the file, and may thus use too many bytes for the file...

See https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/e7046961-3318-4350-be2a-a8d69bb59ce8
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/829f93f5-ed10-4f12-8347-42d235019459

Subtasks 1 (0 open — 1 closed)

Bug #5899: smb: no consistency check between NBSS length and length field for some SMB operations (6.0.x backport)ClosedPhilippe AntoineActions

Related issues 2 (1 open — 1 closed)

Related to Suricata - Bug #5786: smb: possible evasion with trailing nbss dataClosedPhilippe AntoineActions
Blocks Suricata - Feature #4861: smb: support multi-stream file transfersIn ProgressPhilippe AntoineActions

PA Updated by Philippe Antoine over 3 years ago Actions
Copy link
 #1

  • Status changed from New to In Review

PA Updated by Philippe Antoine over 3 years ago Actions
Copy link
 #2

  • Blocks Feature #4861: smb: support multi-stream file transfers added

PA Updated by Philippe Antoine about 3 years ago Actions
Copy link
 #4

  • Related to Bug #5786: smb: possible evasion with trailing nbss data added

PA Updated by Philippe Antoine about 3 years ago Actions
Copy link
 #5

  • Target version changed from TBD to 7.0.0-rc1

PA Updated by Philippe Antoine about 3 years ago Actions
Copy link
 #6

  • Target version changed from 7.0.0-rc1 to 7.0.0-rc2

PA Updated by Philippe Antoine about 3 years ago Actions
Copy link
 #7

  • Status changed from In Review to Closed

Fixed by https://github.com/OISF/suricata/pull/8514

Would we want backports for this ?

PA Updated by Philippe Antoine about 3 years ago Actions
Copy link
 #8

  • Status changed from Closed to Resolved

PA Updated by Philippe Antoine about 3 years ago Actions
Copy link
 #9

  • Subtask #5899 added

VJ Updated by Victor Julien about 3 years ago Actions
Copy link
 #10

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: PDF Atom