Security #5945: byte_math: Division by zero possible. - Suricata - Open Information Security Foundation

Actions

Copy link

Security #5945

closed

byte_math: Division by zero possible.

Added by Jeff Lucovsky about 1 year ago. Updated 10 months ago.

Status:

Closed

Priority:

Normal

Assignee:

Jeff Lucovsky

Target version:

7.0.0-rc2

Affected Versions:

Label:

CVE:

Git IDs:

Severity:

MODERATE

Disclosure Date:

Description

The byte_math keyword supports basic math and shift-left/right operations for the rvalue (either a scalar or variable).

The division operator should check for a zero-value divisor value.

alert tcp any any -> any any (msg:"Testing bytemath_body"; \
                              content:"|00 04 93 F3|";  \
                              content:"|00 00 00 07|"; distance:4; within:4; \
                              byte_math:bytes 4, offset 0, oper /, rvalue \
                              248, relative,result var; sid:1;)

Subtasks 1 (0 open — 1 closed)