From c23e3ca1056c03be347da6163a8e447670ce06b1 Mon Sep 17 00:00:00 2001 From: Johanna Amann Date: Thu, 25 Mar 2021 13:41:12 +0000 Subject: [PATCH] Heartbleed: fix substraction order. The larger number was substracted from the smaller one leading to an integer overflow. However, no information was lost due to everything also being present in the notice message. Fixes GH-1454 --- scripts/policy/protocols/ssl/heartbleed.zeek | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/policy/protocols/ssl/heartbleed.zeek b/scripts/policy/protocols/ssl/heartbleed.zeek index 483c1f4ce1..aabafbff14 100644 --- a/scripts/policy/protocols/ssl/heartbleed.zeek +++ b/scripts/policy/protocols/ssl/heartbleed.zeek @@ -154,7 +154,7 @@ event ssl_encrypted_heartbeat(c: connection, is_orig: bool, length: count) NOTICE([$note=SSL_Heartbeat_Many_Requests, $msg=fmt("Server sending more heartbeat responses than requests seen. Possible attack. Client count: %d, server count: %d", c$ssl$originator_heartbeats, c$ssl$responder_heartbeats), $conn=c, - $n=(c$ssl$originator_heartbeats-c$ssl$responder_heartbeats), + $n=(c$ssl$responder_heartbeats-c$ssl$originator_heartbeats), $identifier=fmt("%s%d", c$uid, c$ssl$responder_heartbeats/1000) # re-throw every 1000 heartbeats ]);