misc_mozilla-sslv2-cmk.c

This is the snapshot of Snot Latest Rules

/*
 * Mozilla Network Security Services SSLv2 Server Stack Overflow
 *
 * Copyright (C) 2007 Sourcefire, Inc. All Rights Reserved
 *
 * Written by Patrick Mullen <[e-mail]>
 *
 * This file may contain proprietary rules that were created, tested and
 * certified by Sourcefire, Inc. (the "VRT Certified Rules") as well as
 * rules that were created by Sourcefire and other third parties and
 * distributed under the GNU General Public License (the "GPL Rules").  The
 * VRT Certified Rules contained in this file are the property of
 * Sourcefire, Inc. Copyright 2005 Sourcefire, Inc. All Rights Reserved.
 * The GPL Rules created by Sourcefire, Inc. are the property of
 * Sourcefire, Inc. Copyright 2002-2005 Sourcefire, Inc. All Rights
 * Reserved.  All other GPL Rules are owned and copyrighted by their
 * respective owners (please see www.snort.org/contributors for a list of
 * owners and their respective copyrights).  In order to determine what
 * rules are VRT Certified Rules or GPL Rules, please refer to the VRT
 * Certified Rules License Agreement.
*/


#include "sf_snort_plugin_api.h"
#include "sf_snort_packet.h"


int ruleMOZILLA_SSLV2_CMKeval(void *p);

/* flow:established, to_server; */
static FlowFlags ruleMOZILLA_SSLV2_CMKflow0 =
{
    FLOW_ESTABLISHED|FLOW_TO_SERVER
};

static RuleOption ruleMOZILLA_SSLV2_CMKoption0 =
{
    OPTION_TYPE_FLOWFLAGS,
    {
        &ruleMOZILLA_SSLV2_CMKflow0
    }
};

/* flowbits:isset "sslv2.server_hello.request"; */
static FlowBitsInfo ruleMOZILLA_SSLV2_CMKflowbits1 =
{
    "sslv2.server_hello.request",
    FLOWBIT_ISSET,
    0, /* flowbits id (SET BY ENGINE) */
    0, /* flags (NOT USED CURRENTLY) */
};

static RuleOption ruleMOZILLA_SSLV2_CMKoption1 =
{
    OPTION_TYPE_FLOWBIT,
    {
        &ruleMOZILLA_SSLV2_CMKflowbits1
    }
};


/* flowbits:isnotset "sslv2.client_master_key.request"; */
static FlowBitsInfo ruleMOZILLA_SSLV2_CMKflowbits2 =
{
    "sslv2.client_master_key.request",
    FLOWBIT_ISNOTSET,
    0, /* flowbits id (SET BY ENGINE) */
    0, /* flags (NOT USED CURRENTLY) */
};

static RuleOption ruleMOZILLA_SSLV2_CMKoption2 =
{
    OPTION_TYPE_FLOWBIT,
    {
        &ruleMOZILLA_SSLV2_CMKflowbits2
    }
};

// content:"|02|", depth 1, offset 3;
static ContentInfo ruleMOZILLA_SSLV2_CMKcontent3 =
{
    (u_int8_t *)"|02|", /* pattern (now in snort content format) */
    1, /* depth */
    2, /* offset */
    0, /* flags */ // XXX - need to add CONTENT_FAST_PATTERN support 
    NULL, /* holder for boyer/moore PTR */
    NULL, /* more holder info - byteform */
    0 /* byteform length */
};

static RuleOption ruleMOZILLA_SSLV2_CMKoption3 =
{
    OPTION_TYPE_CONTENT,
    {
        &ruleMOZILLA_SSLV2_CMKcontent3
    }
};

/* flowbits:set "sslv2.client_master_key.request"; */
static FlowBitsInfo ruleMOZILLA_SSLV2_CMKflowbits4 =
{
    "sslv2.client_master_key.request",
    FLOWBIT_SET,
    0, /* flowbits id (SET BY ENGINE) */
    0, /* flags (NOT USED CURRENTLY) */
};

static RuleOption ruleMOZILLA_SSLV2_CMKoption4 =
{
    OPTION_TYPE_FLOWBIT,
    {
        &ruleMOZILLA_SSLV2_CMKflowbits4
    }
};


/* references for.ruleid MOZILLA_SSLV2_CMK */
static RuleReference ruleMOZILLA_SSLV2_CMKref0 =
{
    "cve", /* type */
    "2007-0009" /* value */
};

static RuleReference ruleMOZILLA_SSLV2_CMKref1 =
{
    "bugtraq", /* type */
    "22694" /* value */
};

static RuleReference ruleMOZILLA_SSLV2_CMKref2 =
{
    "url", /* type */
    "labs.idefense.com/intelligence/vulnerabilities/display.php?id=482" /* value */
};

static RuleReference *ruleMOZILLA_SSLV2_CMKrefs[] =
{
    &ruleMOZILLA_SSLV2_CMKref0,
    &ruleMOZILLA_SSLV2_CMKref1,
    &ruleMOZILLA_SSLV2_CMKref2,
    NULL
};


RuleOption *ruleMOZILLA_SSLV2_CMKoptions[] =
{
    &ruleMOZILLA_SSLV2_CMKoption0,
    &ruleMOZILLA_SSLV2_CMKoption1,
    &ruleMOZILLA_SSLV2_CMKoption2,
    &ruleMOZILLA_SSLV2_CMKoption3,
    &ruleMOZILLA_SSLV2_CMKoption4,
    NULL
};

Rule ruleMOZILLA_SSLV2_CMK = {
   /* rule header, akin to => tcp $EXTERNAL_NET any -> $HOME_NET $HTTPS_PORTS */
   {
       IPPROTO_TCP, /* proto */
       EXTERNAL_NET, /* SRCIP     */
       "any", /* SRCPORT   */
       0, /* DIRECTION */
       HOME_NET, /* DSTIP     */
       "443", /* DSTPORT   */
   },
   /* metadata */
   {
       3,  /* genid (HARDCODED!!!) */
       11672, /* sigid ca482430-c460-4336-862c-690c7f5dbabc */
       2, /* revision 21caa5d4-6486-4cd1-98da-5265263199be */

       "attempted-admin", /* classification */
       0,  /* hardcoded priority XXX NOT PROVIDED BY GRAMMAR YET! */
       "MISC Mozilla Network Security Services SSLv2 stack overflow attempt",     /* message */
       ruleMOZILLA_SSLV2_CMKrefs /* ptr to references */
#ifdef HAS_METADATA
        ,NULL
#endif
   },
   ruleMOZILLA_SSLV2_CMKoptions, /* ptr to rule options */
   &ruleMOZILLA_SSLV2_CMKeval, 
   0, /* am I initialized yet? */
   0, /* number of options */
   0,  /* don't alert */
   NULL /* ptr to internal data... setup during rule registration */
};

int ruleMOZILLA_SSLV2_CMKeval(void *p) {
   const u_int8_t *cursor_normal = 0;
   u_int16_t cipher_keybits, clear_key_data_length;

   SFSnortPacket *sp = (SFSnortPacket *) p; 

   /* Make sure the packet is long enough */
   if(sp->payload_size < 8)
      return RULE_NOMATCH;

   // flow:established, to_server;
   if(checkFlow(p, ruleMOZILLA_SSLV2_CMKoptions[0]->option_u.flowFlags) > 0 ) {

      // The checks here have essentially been reversed in an attempt to drop out of
      // this function as quickly as possible by (not) matching the most packets as
      // possible right away.

      // content:"|02|", depth 1; offset 2;
      if(contentMatch(p, ruleMOZILLA_SSLV2_CMKoptions[3]->option_u.content, &cursor_normal) > 0) {

         // flowbits:isnotset "sslv2.client_master_key.request";
         if(processFlowbits(p, ruleMOZILLA_SSLV2_CMKoptions[2]->option_u.flowBit) > 0) {

            // flowbits:isset "sslv2.server_hello.request";
            if(processFlowbits(p, ruleMOZILLA_SSLV2_CMKoptions[1]->option_u.flowBit) > 0) {
	   
               // Set our flowbit 
               // flowbits:set "sslv2.client_master_key.request";
               if(processFlowbits(p, ruleMOZILLA_SSLV2_CMKoptions[4]->option_u.flowBit) > 0) { 

                  /* Take the important values out of the packet */
                  cipher_keybits = ntohs(*(u_int16_t*)(&(sp->payload[4])));
                  clear_key_data_length = ntohs(*(u_int16_t*)(&(sp->payload[6])));
 
                  /* Now we do actual detection. */
                  if((cipher_keybits + 7)/8 - clear_key_data_length < 0)
                     return RULE_MATCH;
               }  
            }  
         }  
      }  
   }  

   return RULE_NOMATCH;
}