Suricata

Bug #9371

Updated by Victor Julien 4 days ago

    Two NFS decoding defects affect released versions (verified present in main and                                                                                                                                  
    main-8.0.x):                                                                                                                                                                                                     

                                                                                                                                                                                                     
                                                                                                                                                                                                                   
    - READDIRPLUS replies: entries are parsed with `many0(complete(...))`, so they 
                                                                                                                                     
      decode only when the whole reply is available in one buffer. When the reply is 
                                                                                                                                   
      split across TCP segments the entry list is dropped, and the dirlist chain 
                                                                                                                                       
      (cookie / eof) is not followed, so names and file info for the directory 
                                                                                                                                         
      contents are lost. 
                                                                                                                                                                                             
    - Malformed data: the event is set on the parser disector state instead of on the 
                                                                                                                                         
      transaction the record creates, so it is reported on every transaction of the 
                                                                                                                                    
      flow rather than the one at fault - or on none, when the record fails before a 
                                                                                                                                   
      transaction exists.                                                                                                                                                                                            

Back