Project

General

Profile

Actions

Feature #8179

closed
AS PA

dcerpc.opnum: doesn't support operators >,<,!,=

Feature #8179: dcerpc.opnum: doesn't support operators >,<,!,=

Added by Alexander Stadnikov 4 months ago. Updated about 4 hours ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

Recently our networking analysts found out that dcerpc.opnum and it's sibling dce_opnum don't support operators >,<,!,=

Suricata prints the error "Error parsing dce_opnum option in signature" while parsing rule:

alert tcp any any -> any any (msg:"CVE-2024-38073"; sid:200; rev:1; flow:to_server,established; dcerpc.opnum:>1;)

The rule might be easily replaced by:

alert tcp any any -> any any (msg:"CVE-2024-38073"; sid:200; rev:1; flow:to_server,established; dcerpc.opnum:2-65535;)

It seems the keyword is important and if it's a real problem then a Redmine ticket could be found but I didn't find anything related to it.
I think it's the documentation issue.

All operators might be easily replaced by precise numbers and/or ranges.

I checked also the implementation and I see the functionality was never present.


Related issues 3 (2 open1 closed)

Related to Suricata - Task #6644: tracking: detect: integer as first-class supportIn ProgressPhilippe AntoineActions
Related to Suricata - Optimization #8391: detect/dcerpc: move code to rustIn ProgressPhilippe AntoineActions
Copied to Suricata - Documentation #8330: doc: explain dcerpc.opnum doesn't support operators >,<,!,=ClosedVictor JulienActions
Actions

Also available in: PDF Atom