https://github.com/zeek/zeek/releases/tag/v8.0.9
This release fixes the following potential DoS vulnerabilities:
- The NVT, Rlogin, and RSH analyzers have received fixes to avoid
unbounded state growth. Due to the fact that these packets can
be received from remote hosts, these are considered DoS risks.
- A specially crafted WebSocket payload can cause the Spicy WebSocket
analyzer to use excessive memory when processing close, ping,
and pong frames. Due to the fact that these packets can be
received from remote hosts, these are considered a DoS risk.
- A specially crafted series of Finger packets can cause the Spicy
Finger analyzer to use excessive amounts of memory and potentially
crash Zeek. Due to the fact that these packets can be received
from remote hosts, this is considered a DoS risk.
- A specially crafted Kerberos packet can cause the Kerberos
analyzer to enter an invalid state and potentially crash Zeek.
Due to the fact that these packets can be received from remote
hosts, this is considered a DoS risk.
- A specially crafted series of RDP packets can cause the RDP
analyzer to use excessive amounts of memory and potentially crash
Zeek. Due to the fact that these packets can be received from
remote hosts, this is considered a DoS risk.
- A specially crafted IP packet can cause the IP analyzer to read
past the end of the contents of the packet when emitting the
packet_contents event and possibly crash. Due to the fact that
these packets can be received from remote hosts, this is considered
a DoS risk.
- A specially crafted IP packet can cause the packet discarding
code to read off the end of the packet when looking for follow-on
header data. This may potentially lead to a crash of Zeek. Due
to the fact that these packets can be received from remote hosts,
this is considered a DoS risk.
- A specially crafted series of Gnutella packets may cause Zeek
to continue accumulating memory and eventually crash. Due to the
fact that these packets can be received from remote hosts, this
is considered a DoS risk.
- A specially crafted ICMPv6 packet can cause the ICMP analyzer
to skip part of the packet and not report corresponding events
and logs. Due to the fact that these packets can be received
from remote hosts, this is considered an evasion risk.
- A specially crafted SSH packet can cause the SSH analyzer to
throw BinPAC exceptions for extremely large packets and skip
logging them otherwise. Due to the fact that these packets can
be received from remote hosts, this is considered an evasion
risk.
- A number of issues with the HTTP analyzer were found involving
unusual Content-Length, Transfer-Encoding and Expect header
usage. Due to the fact that these packets can be received from
remote hosts, this is considered an evasion risk.
- A series of fixes were applied to the serialization code in Zeek
to avoid buffer overreads with both Broker and ZeroMQ traffic.
On debug builds, these hit various abort() conditions and cause
Zeek to exit. Due to the fact that all of these states require
direct access to the Broker/ZeroMQ ports (meaning access to the
local network to some degree), this isn’t considered a DoS risk.
This release fixes the following bugs:
- Zeek now builds correctly with newer versions of LibreSSL.
- ZeekJS was updated to v0.23.0, which brings compatibility with
Node v26.
- Spicy was updated to v1.14.1.
- The TCP analyzer now clamps the window scale to 14 bytes, which
conforms with RFC7323.
- The Geneve analyzer now properly parses encapsulated IPv6 packets.
- A regression in the management framework's handling of metrics-port
collision avoidance was fixed.
- A number of out-of-bounds reads where fixed in the following
analyzers: BitTorrent, DCE-RPC, GSS-API, GTPv1, IRC, KRB, Login,
NetBIOS, NFLog, and SSL.
- A number of signed bit-shifting issues were fixed in the following
analyzers: ASN.1, DNS, DTLS, FTP, Geneve, IP, NetBIOS, Null,
RFB, SNAP, SMB, and VXLAN.
- The Ident analyzer fixed a potential signed overflow when parsing
port information.
- A bug was fixed in the pcapng packet source with handling empty
options blocks.
- A potential segfault was fixed with the global_ids BIF if it was
called during startup before all of the script-level type data
was fully parsed.
- The NTP analyzer gained some additional length checking when
parsing extension fields to avoid potential integer overflows.
- Certain protocol fields in the RDP parser are capped to maximum
values to prevent unbounded buffering.
- A few fixes were applied to the handling of HTTP Content-Range
values to avoid integer overflows.
- The GENEVE and VXLAN analyzers now use the correct packet object
when parsing the inner packet, avoiding a possible null pointer
dereference.
Reported by: Tim Wojtulewicz
Craig Leres
2fb62f74e6