Suricata

Bug #9371

Updated by Victor Julien 4 days ago

     Two The NFS decoding defects affect released versions (verified present in main disector parses several record layouts incorrectly, so events and                                                                                                                                  
    main-8.0.x):                                                                                                                                                                                                     
                                                                                                                                                                                                                   
    file                                                                                                                                   
    transactions do not match the traffic:                                                                                                                                                                           
                                                                                                                                                                                                                   
    - READDIRPLUS replies: entries are parsed with `many0(complete(...))`, so they                                                                                                                                   
      decode only when the whole reply v2/v3 arguments: `fattr3` is available in one buffer. When missing for LOOKUP, REMOVE, RMDIR and RENAME; the reply is                                                                                                                                 
      split across TCP segments the entry list SETATTR `sattr3` layout is dropped, and wrong; FSINFO fields read at the wrong offsets; the                                                                                                                                 
      READDIRPLUS dirlist chain                                                                                                                                     
      (cookie / eof) is does not followed, so names and file info for follow the directory                                                                                                                                       
      contents are lost.                                                                                                                                                                                             
    RFC 1813 encoding;                                                                                                                                                     
    - Malformed data: WRITE file transactions complete from the event is set on the disector state reply instead of on the                                                                                                                                       
      transaction request side;                                                                                                                                   
    - the record creates, so it RPC record-mark length is reported unbounded during stream reassembly;                                                                                                                                              
    - malformed data raises on every transaction of the                                                                                                                                  
      flow rather than the one at fault - wrong transaction, or on none, when the record fails before a                                                                                                                                 
      transaction exists.                                                                                                                                                                                             none;                                                                                                                                                    
    - v4.1 backchannel and protocol-probe directions are inverted.                                                                                                                                                   

Back