Project

General

Profile

Actions

Bug #5770

closed

smb: no consistency check between NBSS length and length field for some SMB operations

Added by Philippe Antoine 9 months ago. Updated 6 months ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

For instance for SMB2 write request, the Length field indicates the length of the buffer contained in the NBSS record
But Suricata takes into account this length independently of the NBSS length for the file, and may thus use too many bytes for the file...

See https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/e7046961-3318-4350-be2a-a8d69bb59ce8
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/829f93f5-ed10-4f12-8347-42d235019459


Subtasks 1 (0 open1 closed)

Bug #5899: smb: no consistency check between NBSS length and length field for some SMB operations (6.0.x backport)ClosedPhilippe AntoineActions

Related issues 2 (1 open1 closed)

Related to Suricata - Bug #5786: smb: possible evasion with trailing nbss dataClosedPhilippe AntoineActions
Blocks Suricata - Feature #4861: smb: support multi-stream file transfersIn ProgressPhilippe AntoineActions
Actions #1

Updated by Philippe Antoine 9 months ago

  • Status changed from New to In Review
Actions #2

Updated by Philippe Antoine 9 months ago

  • Blocks Feature #4861: smb: support multi-stream file transfers added
Actions #4

Updated by Philippe Antoine 9 months ago

  • Related to Bug #5786: smb: possible evasion with trailing nbss data added
Actions #5

Updated by Philippe Antoine 9 months ago

  • Target version changed from TBD to 7.0.0-rc1
Actions #6

Updated by Philippe Antoine 8 months ago

  • Target version changed from 7.0.0-rc1 to 7.0.0-rc2
Actions #7

Updated by Philippe Antoine 7 months ago

  • Status changed from In Review to Closed

Fixed by https://github.com/OISF/suricata/pull/8514

Would we want backports for this ?

Actions #8

Updated by Philippe Antoine 7 months ago

  • Status changed from Closed to Resolved
Actions #9

Updated by Philippe Antoine 7 months ago

  • Subtask #5899 added
Actions #10

Updated by Victor Julien 6 months ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF