suricata icon indicating copy to clipboard operation
suricata copied to clipboard

smb/ntlmssp: improve version check

Open victorjulien opened this issue 1 week ago • 1 comments

Don't assume the ntlmssp version field is always present if the flag is set. Instead keep track of the offsets of the data of the various blobs and see if there is space for the version.

Inspired by how Wireshark does the parsing.

Bug: #7121.

Private Pcap, so no public test.

Replaces #11368, fixing rust issues.

victorjulien avatar Jun 25 '24 19:06 victorjulien