zeek -- potential DoS vulnerabilities
Tim Wojtulewicz of Corelight reports:
A missing field in the SMB FSControl script-land record could
cause a heap buffer overflow when receiving packets containing
those header types.
Receiving a series of packets that start with HTTP/1.0
and then switch to HTTP/0.9 could cause Zeek to spend a
large amount of time processing the packets.
Receiving large numbers of FTP commands sequentially
from the network with bad data in them could cause Zeek
to spend a large amount of time processing the packets,
and generate a large amount of events.
Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright