Project

General

Profile

Actions

Bug #7254

open

dcerpc: parser does not support multiple PDUs

Added by Shivani Bhardwaj over 1 year ago. Updated 2 days ago.

Status:
In Review
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

dcerpc parser does not support parsing multiple PDUs in the input buffer. It takes the input, parses the first PDU, and if it succeeds, returns ok to the common applayer parser.

The common applayer parser then assumes that the entire data that was sent to the protocol parser was successfully parsed and consumed. It then updates the stream progress to reflect the same.


Subtasks 1 (1 open0 closed)

Bug #8374: dcerpc: parser does not support multiple PDUs (8.0.x backport)AssignedPhilippe AntoineActions

Related issues 5 (2 open3 closed)

Related to Suricata - Optimization #7251: dcerpc: mimic gap behavior if invalid data is sent to protocol parserIn ReviewShivani BhardwajActions
Blocked by Suricata - Bug #5133: dcerpc: logs not created after unhandled packet such as auth3In ReviewPhilippe AntoineActions
Copied to Suricata - Bug #7546: dcerpc: parser does not take fraglen into accountClosedShivani BhardwajActions
Copied to Suricata - Bug #7547: dcerpc: parser uses only one header for both directionsClosedPhilippe AntoineActions
Copied to Suricata - Bug #7548: dcerpc: avoid integer underflowClosedPhilippe AntoineActions
Actions #1

Updated by Philippe Antoine about 1 year ago

  • Copied to Bug #7546: dcerpc: parser does not take fraglen into account added
Actions #2

Updated by Philippe Antoine about 1 year ago

  • Copied to Bug #7547: dcerpc: parser uses only one header for both directions added
Actions #3

Updated by Philippe Antoine about 1 year ago ยท Edited

  • Subject changed from dcerpc: parser does not support multiple PDUs to dcerpc: event on fraglen < 16
Actions #4

Updated by Philippe Antoine about 1 year ago

  • Subject changed from dcerpc: event on fraglen < 16 to dcerpc: parser does not support multiple PDUs
Actions #5

Updated by Philippe Antoine about 1 year ago

  • Copied to Bug #7548: dcerpc: avoid integer underflow added
Actions #6

Updated by Victor Julien 12 months ago

  • Target version changed from 8.0.0-beta1 to 8.0.0-rc1
Actions #7

Updated by Victor Julien 9 months ago

  • Target version changed from 8.0.0-rc1 to 9.0.0-beta1
Actions #8

Updated by Philippe Antoine 8 months ago

  • Affected Versions 8.0.0 added
Actions #9

Updated by Philippe Antoine 2 days ago

  • Status changed from Assigned to In Review
  • Assignee changed from Shivani Bhardwaj to Philippe Antoine
  • Label Needs backport to 8.0 added
Actions #10

Updated by OISF Ticketbot 2 days ago

  • Subtask #8374 added
Actions #11

Updated by OISF Ticketbot 2 days ago

  • Label deleted (Needs backport to 8.0)
Actions #12

Updated by Philippe Antoine 2 days ago

  • Related to Optimization #7251: dcerpc: mimic gap behavior if invalid data is sent to protocol parser added
Actions #13

Updated by Philippe Antoine 2 days ago

  • Blocked by Bug #5133: dcerpc: logs not created after unhandled packet such as auth3 added
Actions

Also available in: Atom PDF