Bug #5201: content:"22 2 22"; is parsed without error - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #5201

closed

content:"22 2 22"; is parsed without error

Added by Gianni Tedesco over 2 years ago. Updated over 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Jason Ish

Target version:

7.0.0-beta1

Affected Versions:

6.0.4

Effort:

Difficulty:

Label:

Needs backport to 5.0, Needs backport to 6.0

Description

This should probably cause suricata to freak out. It was a rule bug in 2035512 and according to @bmurphy even snort throws an error on this.

Related issues 2 (0 open — 2 closed)

Actions

Copy link

Updated by Brandon Murphy over 2 years ago

Given the following rule:

alert tcp any any -> any any (msg:"test"; content:"|22 2 22|"; sid:1;)

Based on the fast_pattern analysis, Suricata appears to accept this incorrect hex content and actually skips the invalid byte.

== Sid: 1 ==
alert tcp any any -> any any (msg:"test"; content:"|22 2 22|"; sid:1;)
    Fast Pattern analysis:
        Fast pattern matcher: content
        Flags: None
        Fast pattern set: no
        Fast pattern only set: no
        Fast pattern chop set: no
        Original content: \x22\x22
        Final content: \x22\x22

For comparison sake, snort throws the following fatal error

Initializing rule chains...
ERROR: /tmp/test.rules Content hexmode argument has invalid number of hex digits.  The argument '|22 2 22|' must contain a full even byte string.
Fatal Error, Quitting..

Ideally we can get at least a warning generated on this condition?

Actions

Copy link