Project

General

Profile

Actions
Copy link

Security #5945

closed

byte_math: Division by zero possible.

Added by Jeff Lucovsky almost 2 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
Jeff Lucovsky
Target version:
7.0.0-rc2
Affected Versions:
Label:
CVE:
Git IDs:
Severity:
MODERATE
Disclosure Date:

Description

The byte_math keyword supports basic math and shift-left/right operations for the rvalue (either a scalar or variable).

The division operator should check for a zero-value divisor value.

alert tcp any any -> any any (msg:"Testing bytemath_body"; \
                              content:"|00 04 93 F3|";  \
                              content:"|00 00 00 07|"; distance:4; within:4; \
                              byte_math:bytes 4, offset 0, oper /, rvalue \
                              248, relative,result var; sid:1;)

Subtasks 1 (0 open — 1 closed)

Security #5947: byte_math: Division by zero possible. (6.0.x backport)ClosedJeff LucovskyActions
Actions
Copy link

Also available in: Atom PDF