Bug #4261: Mismatch between capture and outputs in rules leads to seg fault - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #4261

closed

Mismatch between capture and outputs in rules leads to seg fault

Added by Shawn Yao almost 4 years ago. Updated over 3 years ago.

Status:

Closed

Priority:

High

Assignee:

Jeff Lucovsky

Target version:

7.0.0-beta1

Affected Versions:

Effort:

Difficulty:

low

Label:

Needs backport to 5.0, Needs backport to 6.0

Description

Parsing bug: Given 2 or more outputs for one capture in the regex, there will be a segmentation fault.

For example,

alert tcp any any -> any any (msg:"get username in nntp"; \

content:"USER"; \
pcre: "/AUTHINFO USER\r\n/i, pkt:nntp_username, pkt:nntp_password";\
sid:2000020;\
gid:100;)

Files

Download all files

bug2.png (34.5 KB) bug2.png		Shawn Yao, 01/12/2021 05:18 AM
bug1.png (41.2 KB) bug1.png		Shawn Yao, 01/12/2021 05:18 AM
nntp.pcap (177 KB) nntp.pcap	you can try it now	Shawn Yao, 02/07/2021 06:53 AM

Related issues 2 (0 open — 2 closed)

Actions

Copy link

Updated by Shawn Yao almost 4 years ago

For example,

alert tcp any any -> any any (msg:"get username in nntp"; \
content:"USER"; \
pcre: "/AUTHINFO USER\r\n/i, pkt:nntp_username, pkt:nntp_password";\
sid:2000020;\
gid:100;)

Actions

Copy link

Updated by Shawn Yao almost 4 years ago

I'm not familiar to this editor.
If you want to see details, Open the bug pics, pls.

Actions

Copy link

Updated by Victor Julien almost 4 years ago

Status changed from New to Assigned
Assignee changed from Eric Leblond to Jeff Lucovsky
Target version set to 7.0.0-beta1
Label Needs backport to 5.0, Needs backport to 6.0 added

Actions

Copy link

Updated by Jeff Lucovsky over 3 years ago

Copied to Bug #4287: Mismatch between capture and outputs in rules leads to seg fault added

Actions

Copy link

Updated by Jeff Lucovsky over 3 years ago

Copied to Bug #4288: Mismatch between capture and outputs in rules leads to seg fault added

Actions

Copy link

Updated by Jeff Lucovsky over 3 years ago

Can you share your pcap file?

Actions

Copy link

Updated by Shawn Yao over 3 years ago

File nntp.pcap nntp.pcap added

alert tcp any any -> any any (msg:"nntp get username";\
        content:"AUTHINFO USER";\
        pcre: "/AUTHINFO USER\s+([^\s]+)\r\n/i, pkt:nntp_user, pkt:nntp_pass";\
        sid:2000030;\
        gid:100;)

The key for test, you should write the number of "pkt" or "flow" more than groups in pcre.

Actions

Copy link

Updated by Jeff Lucovsky over 3 years ago

I've identified a fix .. until it's ready, please try a rule with two captures.
The rule you listed only captures the NNTP user -- this triggers the segfault (which will be fixed).

Actions

Copy link