Zeek Files

Thank you to Jan Grashöfer (@J-Gras), h4r4kIR1, Javid Khan (@dxbjavid), @jmestwa-coder, and @uwezkhan for their contributions to this release.

This release fixes the following security issues:

• HIGH: The NVT, Rlogin, and RSH analyzers have received fixes to avoid unbounded state growth. Due to the fact that these packets can be received from remote hosts, these are considered DoS risks. The fixes include additional length-checking when processing packets, as well as a new set of weirds for when the standard Content-Line limits are exceeded.

• HIGH: A specially crafted WebSocket payload can cause the Spicy WebSocket analyzer to use excessive memory when processing close, ping, and pong frames. Due to the fact that these packets can be received from remote hosts, these are considered a DoS risk. The fix caps the size of those frames as per RFC 6455 (to 125 bytes) and adds a new weird for when that limit is exceeded.

• HIGH: A specially crafted series of Finger packets can cause the Spicy Finger analyzer to use excessive amounts of memory and potentially crash Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix includes a new Finger::max_line_length script constant. Spicy will report protocol violations if this limit is exceeded.

• HIGH: A specially crafted Kerberos packet can cause the Kerberos analyzer to enter an invalid state and potentially crash Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix includes additional checks for the state reported by the Kerberos packets.

• HIGH: A specially crafted series of RDP packets can cause the RDP analyzer to use excessive amounts of memory and potentially crash Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix includes a new rpc_max_pending_calls script constant. If this limit is exceeded, a new rpc_discarded_pending_calls event is emitted and a weird is reported.

• HIGH: A specially crafted IP packet can cause the IP analyzer to read past the end of the contents of the packet when emitting the packet_contents event and possibly crash. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. The fix changes how Zeek checks the remaining length of the packet when emitting the event. The packet_contents event typically isn't used in production setups.

• HIGH: A specially crafted IP packet can cause the packet discarding code to read off the end of the packet when looking for follow-on header data. This may potentially lead to a crash of Zeek. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. Note that this only applies if the user enables the discarder by implementing one of the discarder_check_* script functions. The fix includes additional length checks to the IP_HDr::ToPktHdrVal method to skip looking for additional headers if there isn’t enough data.

• HIGH: A specially crafted series of Gnutella packets may cause Zeek to continue accumulating memory and eventually crash. Due to the fact that these packets can be received from remote hosts, this is considered a DoS risk. Note that the Gnutella analyzer is disabled by default. The fix includes new Gnutella::max_line_length and Gnutella::max_header_length script constant values to control the maximum size of data processed, as well as new weirds for when the limits are exceeded.

• MEDIUM: A specially crafted ICMPv6 packet can cause the ICMP analyzer to skip part of the packet and not report corresponding events and logs. Due to the fact that these packets can be received from remote hosts, this is considered an evasion risk. The fix includes additional length-checking and five new weirds to cover the cases where the checks fail.

• MEDIUM: A specially crafted SSH packet can cause the SSH analyzer to throw BinPAC exceptions for extremely large packets and skip logging them otherwise. Due to the fact that these packets can be received from remote hosts, this is considered an evasion risk. The fix includes new SSH::max_packet_length and SSH::max_string_length script constants to control the maximum size of SSH packets and strings, as well as new weirds for when the limits are exceeded.

• MEDIUM: A number of issues with the HTTP analyzer were found involving unusual Content-Length, Transfer-Encoding and Expect header usage. Due to the fact that these packets can be received from remote hosts, this is considered an evasion risk. The fixes add additional validity checks as well as a new set of weirds for violations.

• MEDIUM: A series of fixes were applied to the serialization code in Zeek to avoid buffer overreads with both Broker and ZeroMQ traffic. On debug builds, these hit various abort() conditions and cause Zeek to exit. Due to the fact that all of these states require direct access to the Broker/ZeroMQ ports (meaning access to the local network to some degree), this isn’t considered a DoS risk. The fixes include additional checks for message format validity and message lengths.

This release fixes the following bugs:

• Zeek now builds correctly with newer versions of LibreSSL.

• ZeekJS was updated to v0.23.0, which brings compatibility with Node v26.

• Spicy was updated to v1.14.1. This release includes a fix that resolves crashes when running on Fedora 44 ARM hosts.

• The TCP analyzer now clamps the window scale to 14 bytes, which conforms with RFC7323. If the limit is excceeded, a new TCP_scale_range weird is logged.

• The Geneve analyzer now properly parses encapsulated IPv6 packets.

• A regression in the management framework's handling of metrics-port collision avoidance was fixed. The regression was originally added in 7.2.0.

• A number of out-of-bounds reads where fixed in the following analyzers: BitTorrent, DCE-RPC, GSS-API, GTPv1, IRC, KRB, Login, NetBIOS, NFLog, and SSL. These reads can result in various protocol violations, included parsing evasions on release builds or potential crashes under UBSan and ASan.

• A number of signed bit-shifting issues were fixed in the following analyzers: ASN.1, DNS, DTLS, FTP, Geneve, IP, NetBIOS, Null, RFB, SNAP, SMB, and VXLAN. These issues can result in various protocol violations, included parsing evasions on release builds or potential crashes under UBSan and ASan.

• The Ident analyzer fixed a potential signed overflow when parsing port information.

• A bug was fixed in the pcapng packet source with handling empty options blocks. This was a null-dereference that could potentially crash Zeek.

• A potential segfault was fixed with the global_ids BIF if it was called during startup before all of the script-level type data was fully parsed. The fix is to disallow calling global_ids from the GLOBAL context. It must be called from a function, event handler, or hook instead.

• The NTP analyzer gained some additional length checking when parsing extension fields to avoid potential integer overflows. BinPAC exceptions will be reported in analyzer_debug.log if the limits are exceeded. This also prevents signed integer overflow reports from the BinPAC-generated code when running under UBSan.

• Certain protocol fields in the RDP parser are capped to maximum values to prevent unbounded buffering. This also prevents signed integer overflow reports from the BinPAC-generated code when running under UBSan.

• A few fixes were applied to the handling of HTTP Content-Range values to avoid integer overflows. New weirds HTTP_content_range_cannot_parse, HTTP_content_range_cannot_parse, HTTP_non_positive_content_range, and HTTP_content_range_invalid_instance were added for the various ways these checks can be violated.

• The GENEVE and VXLAN analyzers now use the correct packet object when parsing the inner packet, avoiding a possible null pointer dereference. This would cause crashes when running under UBSan.