Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'security/topic/awelzel/215-pop3-mail-null-deref'

Browse source 
* security/topic/awelzel/215-pop3-mail-null-deref:
  POP3: Rework unbounded pending command fix

(cherry picked from commit 7fea32c6edc5d4d14646366f87c9208c8c9cf555)
This commit is contained in:
Christian Kreibich 2024-10-04 10:31:38 -07:00
parent 6dcb3291d2
commit 353c467fb4
10 changed files with 59 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

14
testing/btest/scripts/base/protocols/pop3/bad-list-retr-crafted.zeek Normal file
View file

@ -0,0 +1,14 @@
# @TEST-DOC: Crafted pcap causing crashes due to mail not initialized.
# @TEST-EXEC: zeek -b -r $TRACES/pop3/bad-list-retr-crafted.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff weird.log
# @TEST-EXEC: btest-diff analyzer.log
@load base/frameworks/notice/weird
@load base/protocols/conn
@load base/protocols/pop3
event zeek_init()
{
Analyzer::register_for_port(Analyzer::ANALYZER_POP3, 110/tcp);
}

2
testing/btest/scripts/base/protocols/pop3/redis.zeek
View file

@ -9,6 +9,8 @@
@load base/protocols/conn
@load base/protocols/pop3
redef POP3::max_unknown_client_commands = 3;
event pop3_request(c: connection, is_orig: bool, cmd: string, arg: string)
{
print c$uid, "pop3_request", is_orig, cmd, arg;