diff --git a/scripts/base/frameworks/notice/weird.zeek b/scripts/base/frameworks/notice/weird.zeek index aa7a412bbd..ee8b850dd2 100644 --- a/scripts/base/frameworks/notice/weird.zeek +++ b/scripts/base/frameworks/notice/weird.zeek @@ -206,6 +206,7 @@ export { ["SMB_parsing_error"] = ACTION_LOG, ["no_smb_session_using_parsesambamsg"] = ACTION_LOG, ["smb_andx_command_failed_to_parse"] = ACTION_LOG, + ["smb_tree_connect_andx_response_without_tree"] = ACTION_LOG_PER_CONN, ["transaction_subcmd_missing"] = ACTION_LOG, ["successful_RPC_reply_to_invalid_request"] = ACTION_NOTICE_PER_ORIG, ["SYN_after_close"] = ACTION_LOG, diff --git a/scripts/base/protocols/smb/smb1-main.zeek b/scripts/base/protocols/smb/smb1-main.zeek index e489a5e4e3..cb6831d708 100644 --- a/scripts/base/protocols/smb/smb1-main.zeek +++ b/scripts/base/protocols/smb/smb1-main.zeek @@ -107,6 +107,15 @@ event smb1_tree_connect_andx_request(c: connection, hdr: SMB1::Header, path: str event smb1_tree_connect_andx_response(c: connection, hdr: SMB1::Header, service: string, native_file_system: string) &priority=5 { + # If the current_cmd does not have a referenced tree, then likely we + # missed the SMB_COM_TREE_CONNECT_ANDX. Report a weird and stop. + if ( ! c$smb_state$current_cmd?$referenced_tree ) + { + local addl = fmt("current_cmd=%s", c$smb_state$current_cmd$command); + Reporter::conn_weird("smb_tree_connect_andx_response_without_tree", c, addl); + return; + } + c$smb_state$current_cmd$referenced_tree$service = service; if ( service == "IPC" ) c$smb_state$current_cmd$referenced_tree$share_type = "PIPE"; diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb1-OSS-fuzz-54883/weird.log b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-OSS-fuzz-54883/weird.log new file mode 100644 index 0000000000..31de8a0c7f --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb1-OSS-fuzz-54883/weird.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source +#types time string addr port addr port string string bool string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.0.0.1 38511 10.0.0.2 139 smb_tree_connect_andx_response_without_tree current_cmd=WRITE_ANDX F zeek - +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/smb/smb1-OSS-fuzz-54883.pcap b/testing/btest/Traces/smb/smb1-OSS-fuzz-54883.pcap new file mode 100644 index 0000000000..030189ce65 Binary files /dev/null and b/testing/btest/Traces/smb/smb1-OSS-fuzz-54883.pcap differ diff --git a/testing/btest/scripts/base/protocols/smb/smb1-OSS-fuzz-54883.test b/testing/btest/scripts/base/protocols/smb/smb1-OSS-fuzz-54883.test new file mode 100644 index 0000000000..6c1206ea2c --- /dev/null +++ b/testing/btest/scripts/base/protocols/smb/smb1-OSS-fuzz-54883.test @@ -0,0 +1,10 @@ +#@TEST-EXEC: zeek -b -C -r $TRACES/smb/smb1-OSS-fuzz-54883.pcap %INPUT +#@TEST-EXEC: btest-diff weird.log +#@TEST-EXEC: ! test -f reporter.log + +@load base/protocols/smb +@load base/frameworks/notice/weird + +# The traffic generated by OSS Fuzz is broken to the extreme, ensure +# the analyzer isn't disabled so the original scripting issue triggers. +redef DPD::ignore_violations += { Analyzer::ANALYZER_SMB };