Zeek v8.0.9 Security Bulletin: Multiple Analyzer Vulnerabilities (DoS/Crash)

Vulnerability Overview Zeek version 8.0.9 patches multiple security vulnerabilities, primarily involving Denial of Service (DoS) risks and potential crash issues. These vulnerabilities exist in analyzers such as NVT, Rlogin, RSH, WebSocket, Finger, Kerberos, RDP, IP, Gnutella, ICMPv6, SSH, HTTP, serialization code, ASN.1, DNS, DTLS, FTP, GenEve, IP, NetBIOS, Null, RFB, SMB, VXLAN, Ident, pcapng, NTP, RDP, HTTP Content-Range, GENEVE, and VXLAN. Scope of Impact NVT, Rlogin, RSH Analyzers: Unrestricted state growth may lead to DoS risks. WebSocket Analyzer: Specifically crafted WebSocket payloads may cause memory exhaustion and crashes. Finger Analyzer: Specifically crafted Finger packets may cause memory exhaustion and crashes. Kerberos Analyzer: Specifically crafted Kerberos packets may lead to invalid states and crashes. RDP Analyzer: Specifically crafted RDP packets may cause memory exhaustion and crashes. IP Analyzer: Specifically crafted IP packets may cause out-of-bounds reads past the end of the packet, triggering crashes. Gnutella Analyzer: Specifically crafted Gnutella packets may cause memory accumulation and crashes. ICMPv6 Analyzer: Specifically crafted ICMPv6 packets may cause partial packet skipping, leading to DoS risks. SSH Analyzer: Specifically crafted SSH packets may throw BinPAC exceptions, leading to DoS risks. HTTP Analyzer: Anomalies in , , and headers may lead to DoS risks. Serialization Code: Serialization code related to Broker and ZeroMQ may cause crashes. ASN.1, DNS, DTLS, FTP, GenEve, IP, NetBIOS, Null, RFB, SMB, VXLAN Analyzers: Signed bit-shift issues may cause crashes. Ident Analyzer: Potential signed overflow when parsing port information. pcapng Packet Source: Null pointer dereference issue when handling empty option blocks. NTP Analyzer: Potential integer overflow when parsing extension fields. RDP Analyzer: Certain protocol fields are not limited to a maximum value, potentially causing unbounded buffers. HTTP Content-Range Handling: Maximum values are not limited, potentially causing integer overflows. GENEVE and VXLAN Analyzers: Null pointer dereference issues when parsing inner packets. Remediation Measures NVT, Rlogin, RSH Analyzers: Add length checks to prevent unrestricted state growth. WebSocket Analyzer: Limit frame size to prevent memory exhaustion. Finger Analyzer: Limit maximum line length to prevent memory exhaustion. Kerberos Analyzer: Add state checks to prevent invalid states. RDP Analyzer: Add the script constant to limit the number of pending calls. IP Analyzer: Modify the event to prevent reads beyond the end of the packet. Gnutella Analyzer: Disable the Gnutella analyzer, and add the and script constants. ICMPv6 Analyzer: Add length checks to prevent partial packet skipping. SSH Analyzer: Add the and script constants to limit packet and string sizes. HTTP Analyzer: Add validity checks to prevent anomalies in , , and headers. Serialization Code: Add message format and length validity checks to prevent crashes. ASN.1, DNS, DTLS, FTP, GenEve, IP, NetBIOS, Null, RFB, SMB, VXLAN Analyzers: Fix signed bit-shift issues. Ident Analyzer: Fix signed overflow when parsing port information. pcapng Packet Source: Fix null pointer dereference issue. NTP Analyzer: Add length checks to prevent integer overflows. RDP Analyzer: Limit the maximum values of protocol fields to prevent unbounded buffers. HTTP Content-Range Handling: Limit maximum values to prevent integer overflows. GENEVE and VXLAN Analyzers: Fix null pointer dereference issues. POC Code or Exploit Code No specific POC code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Zeek v8.0.9 Security Bulletin: Multiple Analyzer Vulnerabilities (DoS/Crash)

More from this source