Project

General

Profile

Actions

Documentation #8330

closed
VJ VJ

doc: explain dcerpc.opnum doesn't support operators >,<,!,=

Documentation #8330: doc: explain dcerpc.opnum doesn't support operators >,<,!,=

Added by Victor Julien about 2 months ago. Updated about 1 month ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Recently our networking analysts found out that dcerpc.opnum and it's sibling dce_opnum don't support operators >,<,!,=

Suricata prints the error "Error parsing dce_opnum option in signature" while parsing rule:

alert tcp any any -> any any (msg:"CVE-2024-38073"; sid:200; rev:1; flow:to_server,established; dcerpc.opnum:>1;)

The rule might be easily replaced by:

alert tcp any any -> any any (msg:"CVE-2024-38073"; sid:200; rev:1; flow:to_server,established; dcerpc.opnum:2-65535;)

It seems the keyword is important and if it's a real problem then a Redmine ticket could be found but I didn't find anything related to it.
I think it's the documentation issue.

All operators might be easily replaced by precise numbers and/or ranges.

I checked also the implementation and I see the functionality was never present.


Subtasks 2 (0 open2 closed)

Documentation #8331: doc: explain dcerpc.opnum doesn't support operators >,<,!,= (8.0.x backport)ClosedVictor JulienActions
Documentation #8332: doc: explain dcerpc.opnum doesn't support operators >,<,!,= (7.0.x backport)ClosedVictor JulienActions

Related issues 1 (1 open0 closed)

Copied from Suricata - Feature #8179: dcerpc.opnum: doesn't support operators >,<,!,=In ReviewPhilippe AntoineActions

VJ Updated by Victor Julien about 2 months ago Actions #1

  • Copied from Feature #8179: dcerpc.opnum: doesn't support operators >,<,!,= added

OT Updated by OISF Ticketbot about 2 months ago Actions #2

  • Subtask #8331 added

OT Updated by OISF Ticketbot about 2 months ago Actions #3

  • Label deleted (Needs backport to 8.0)

OT Updated by OISF Ticketbot about 2 months ago Actions #4

  • Subtask #8332 added

OT Updated by OISF Ticketbot about 2 months ago Actions #5

  • Label deleted (Needs backport to 7.0)

VJ Updated by Victor Julien about 2 months ago Actions #6

  • Status changed from New to In Review
  • Assignee changed from OISF Dev to Victor Julien

VJ Updated by Victor Julien about 1 month ago Actions #7

  • Status changed from In Review to Resolved

SB Updated by Shivani Bhardwaj about 1 month ago Actions #8

  • Tracker changed from Feature to Documentation

Feature ticket is linked. The tracker came from #8179. This is just the documentation update, so, updated tracker accordingly.

PA Updated by Philippe Antoine about 1 month ago Actions #9

  • Status changed from Resolved to Closed
Actions

Also available in: PDF Atom