Project

General

Profile

Actions

Bug #5783

closed

smb: wrong endian conversion when parse NTLM Negotiate Flags

Added by b1 tg almost 2 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

NTLM Negotiate Flags value in follow image is 0xe2888215, function parse_ntlm_auth_nego_flags return version_set_flag = 0 on this, which is wrong. This bug can cause NTLM Auth Version be ignored.

pcap screenshot

version_set_flag is at offset 25 by bits:

>>> 0xe2888215 >> 6 &0b1
0
>>> 0xe2888215 >> 25 &0b1
1
>>> 0xe2888215 >> 6 &0b1

I would like to make a pr for this bug, as the Developers Guide said, maybe i need to have the "developer" role?

Bug location: https://github.com/OISF/suricata/blob/55c4834e4e9b14a441b735f84d8d35b4eb151702/rust/src/smb/ntlmssp_records.rs#L71-L73
NegotiateFlags document: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/99d90ff4-957f-4c8a-80e4-5bfe5a9a9832


Files

clipboard-202301122235-jl69q.png (252 KB) clipboard-202301122235-jl69q.png pcap screenshot b1 tg, 01/12/2023 02:35 PM
smb-on-windows-10.pcapng (139 KB) smb-on-windows-10.pcapng pcap b1 tg, 01/12/2023 02:55 PM
smb-on-windows-10.pcap (122 KB) smb-on-windows-10.pcap pcap b1 tg, 02/01/2023 10:40 AM

Subtasks 1 (0 open1 closed)

Bug #5961: smb: wrong endian conversion when parse NTLM Negotiate Flags (6.0.x backport)ClosedPhilippe AntoineActions
Actions #1

Updated by Victor Julien almost 2 years ago

You have the developer role now. Thanks for looking into this.

Actions #2

Updated by Juliana Fajardini Reichow almost 2 years ago

  • Status changed from New to In Review
  • Assignee changed from OISF Dev to b1 tg
  • Target version changed from TBD to 7.0.0-rc1
Actions #3

Updated by Victor Julien almost 2 years ago

  • Target version changed from 7.0.0-rc1 to 7.0.0-rc2
Actions #4

Updated by b1 tg almost 2 years ago

add .pcap file for reference in suricata-verify

Actions #5

Updated by Juliana Fajardini Reichow over 1 year ago

  • Status changed from In Review to Closed
Actions #6

Updated by Philippe Antoine over 1 year ago

  • Status changed from Closed to Assigned
  • Assignee changed from b1 tg to Philippe Antoine
  • Label Needs backport to 6.0 added

Still needs a fix...

Actions #7

Updated by OISF Ticketbot over 1 year ago

  • Subtask #5961 added
Actions #8

Updated by OISF Ticketbot over 1 year ago

  • Label deleted (Needs backport to 6.0)
Actions #9

Updated by Philippe Antoine over 1 year ago

  • Status changed from Assigned to In Review
Actions #10

Updated by Philippe Antoine over 1 year ago

  • Status changed from In Review to Resolved
Actions #11

Updated by Philippe Antoine over 1 year ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF