Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

RDP: Add weird if specification violated for max channels allowed.

Browse source
This commit is contained in:
Vlad Grigorescu 2019-05-29 08:25:08 -05:00
parent 85fc553136
commit 10109b6b93
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/rdp/main.zeek
View file

@ -204,6 +204,10 @@ event rdp_client_network_data(c: connection, channels: ClientChannelList)
c$rdp$client_channels[i] = gsub(channels[i]$name, /\x00+$/, ""); c$rdp$client_channels[i] = gsub(channels[i]$name, /\x00+$/, "");
} }
if ( |channels| > 31 ) {
Reporter::conn_weird("RDP_channels_requested_exceeds_max", c, fmt("%s", |channels|));
}
} }
event rdp_gcc_server_create_response(c: connection, result: count) &priority=5 event rdp_gcc_server_create_response(c: connection, result: count) &priority=5