diff --git a/CHANGES b/CHANGES index 265f047640..2ab33c5eec 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +5.2.0-dev.322 | 2022-11-16 14:51:35 -0700 + + * smb1: Ensure existence of dialect_index in offered dialects (Arne Welzel, Corelight) + 5.2.0-dev.320 | 2022-11-16 14:50:58 -0700 * ssh: Test for c$ssh$analyzer_id existence (Arne Welzel, Corelight) diff --git a/VERSION b/VERSION index ae85632a6c..09ad54c609 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -5.2.0-dev.320 +5.2.0-dev.322 diff --git a/scripts/base/protocols/smb/smb1-main.zeek b/scripts/base/protocols/smb/smb1-main.zeek index 9a19f27b95..a72c401ccf 100644 --- a/scripts/base/protocols/smb/smb1-main.zeek +++ b/scripts/base/protocols/smb/smb1-main.zeek @@ -89,9 +89,10 @@ event smb1_negotiate_response(c: connection, hdr: SMB1::Header, response: SMB1:: { if ( c$smb_state$current_cmd?$smb1_offered_dialects ) { - if ( response?$ntlm ) + local offered_dialects = c$smb_state$current_cmd$smb1_offered_dialects; + if ( response?$ntlm && response$ntlm$dialect_index < |offered_dialects| ) { - c$smb_state$current_cmd$argument = c$smb_state$current_cmd$smb1_offered_dialects[response$ntlm$dialect_index]; + c$smb_state$current_cmd$argument = offered_dialects[response$ntlm$dialect_index]; } delete c$smb_state$current_cmd$smb1_offered_dialects;