Actions
Bug #5770
closedsmb: no consistency check between NBSS length and length field for some SMB operations
Affected Versions:
Effort:
Difficulty:
Label:
Description
For instance for SMB2 write request, the Length field indicates the length of the buffer contained in the NBSS record
But Suricata takes into account this length independently of the NBSS length for the file, and may thus use too many bytes for the file...
See https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/e7046961-3318-4350-be2a-a8d69bb59ce8
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/829f93f5-ed10-4f12-8347-42d235019459
Actions