Re: Bearerbox Panic after receiving CIFS/SMB request at smsbox-port

Hmmm. Interesting. cvs up will update it. However cvs diff doesn't report 
any differences with the old sources (w/ panic). I always run diff before 
updating, to avoid surprises.

Anyway, thanks,
Nikos
----- Original Message ----- 
From: "Alexander Malysh" <[email protected]>
To: "Nikos Balkanas" <[email protected]>
Cc: <[email protected]>
Sent: Tuesday, September 22, 2009 11:54 AM
Subject: Re: Bearerbox Panic after receiving CIFS/SMB request at smsbox-port


> Hi,
>
> don't know why you don't see my patch, cvs up?
>
> here is commited patch again:
>
> diff --git a/gw/msg.c b/gw/msg.c
> index 8fb5017..23af584 100644
> --- a/gw/msg.c
> +++ b/gw/msg.c
> @@ -232,8 +232,11 @@ Msg *msg_unpack_real(Octstr *os, const char  *file, 
> long line, const char *func)
>      switch (msg->type) {
>  #include "msg-decl.h"
>      default:
> -        panic(0, "Internal error: unknown message type: %d",
> +        error(0, "Internal error: unknown message type: %d",
>                msg->type);
> +        msg->type = 0;
> +        msg_destroy(msg);
> +        return NULL;
>      }
>
>      return msg;
>
> Thanks,
> Alexander Malysh
>
> Am 22.09.2009 um 09:34 schrieb Nikos Balkanas:
>
>> Hi Alex,
>>
>> No problem. It was quite trivial. But i ask because I don't see the  same 
>> fix. Which file did you patch?
>>
>> BR,
>> Nikos
>> ----- Original Message ----- From: "Alexander Malysh" <[email protected]
>> >
>> To: "Nikos Balkanas" <[email protected]>
>> Cc: <[email protected]>
>> Sent: Tuesday, September 22, 2009 10:30 AM
>> Subject: Re: Bearerbox Panic after receiving CIFS/SMB request at 
>> smsbox-port
>>
>>
>>> Hi Nikos,
>>>
>>> hmm I saw your patch after I commited my version. sorry...
>>>
>>> Thanks,
>>> Alexander Maysh
>>>
>>> Am 20.09.2009 um 21:58 schrieb Nikos Balkanas:
>>>
>>>> Hi Alex,
>>>>
>>>> Which one? I just sent a patch about the very same thing 10 hrs ago.
>>>>
>>>> BR,
>>>> Nikos
>>>> ----- Original Message ----- From: "Alexander Malysh" 
>>>> <[email protected]
>>>> >
>>>> To: "Michael Zervakis" <[email protected]>
>>>> Cc: <[email protected]>
>>>> Sent: Sunday, September 20, 2009 9:21 PM
>>>> Subject: Re: Bearerbox Panic after receiving CIFS/SMB request at 
>>>> smsbox-port
>>>>
>>>>
>>>>> Hi,
>>>>>
>>>>> thanks for report. I just fixed this issue in cvs. Please retest.
>>>>>
>>>>> Thanks,
>>>>> Alexander Malysh
>>>>>
>>>>> Am 18.09.2009 um 17:00 schrieb Michael Zervakis:
>>>>>
>>>>>> Dear all,
>>>>>>
>>>>>> During testing of Bearerbox using version cvs-20090506 I found   that 
>>>>>> if smsbox socket receives a CIFS/SMB request bearerbox   panics. This 
>>>>>> means that a malicious user could easily crash   bearerbox simply by 
>>>>>> scanning the host (for example via nmap -sV).
>>>>>>
>>>>>> 2009-09-18 17:09:18 [2002] [5] DEBUG: Started thread 30 (gw/ 
>>>>>> bb_boxc.c:function)
>>>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: Internal error: unknown 
>>>>>> message type: -11317950
>>>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox(gw_panic +0xbc) 
>>>>>> [0x80d8fcc]
>>>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: ./ bearerbox(msg_unpack_real 
>>>>>> +0x78) [0x8065c88]
>>>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox [0x8057e50]
>>>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox [0x80596b9]
>>>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: ./bearerbox [0x80cfafd]
>>>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: /lib/libpthread.so.0 
>>>>>> [0xb7faa1b5]
>>>>>> 2009-09-18 17:09:18 [2002] [30] PANIC: /lib/libc.so.6(clone +0x5e) 
>>>>>> [0xb7abd3be]
>>>>>>
>>>>>>
>>>>>> addr2line -e /usr/gateway/sbin/bearerbox 0x80d8fcc 0x8065c88 
>>>>>> 0x8057e50 0x80596b9 0x80cfafd 0xb7faa1b5 0xb7abd3be
>>>>>> /usr/src/packages/SOURCES/gateway/gwlib/log.c:542
>>>>>> /usr/src/packages/SOURCES/gateway/gw/msg.c:245
>>>>>> /usr/src/packages/SOURCES/gateway/gw/bb_boxc.c:199
>>>>>> /usr/src/packages/SOURCES/gateway/gw/bb_boxc.c:656
>>>>>> /usr/src/packages/SOURCES/gateway/gwlib/gwthread-pthread.c:135
>>>>>> ??:0
>>>>>> ??:0
>>>>>>
>>>>>> Tcpdump
>>>>>> 17:09:18.100983 IP 10.12.0.50.29000 > 172.31.1.48.4201: S 
>>>>>> 3500919925:3500919925(0) ack 739634900 win 5840 <mss 1460,nop,
>>>>>> nop,sackOK>
>>>>>>     0x0000:  4500 0030 0000 4000 4006 e747 c129 e507  E.. 
>>>>>> 0..@[email protected].)..
>>>>>>     0x0010:  ac1f 0130 7148 1069 d0ab cc75 2c15 eed4  ... 
>>>>>> 0qH.i...u,...
>>>>>>     0x0020:  7012 16d0 df01 0000 0204 05b4 0101 0402 
>>>>>> p...............
>>>>>> 17:09:18.101524 IP 172.31.1.48.4201 > 10.12.0.50.29000: . ack 1   win 
>>>>>> 65535
>>>>>>     0x0000:  4500 0028 939b 4000 7e06 15b4 ac1f 0130  E.. 
>>>>>> (..@.~......0
>>>>>>     0x0010:  c129 e507 1069 7148 2c15 eed4 d0ab    cc76 
>>>>>> .)...iqH,......v
>>>>>>     0x0020:  5010 ffff 2296 0000 0000 0000 0000 
>>>>>> P...".........
>>>>>> 17:09:18.114337 IP 172.31.1.48.4201 > 10.12.0.50.29000: P 
>>>>>> 1:169(168) ack 1 win 65535
>>>>>>     0x0000:  4500 00d0 939e 4000 7e06 1509 ac1f 0130 
>>>>>> E.....@.~......0
>>>>>>     0x0010:  c129 e507 1069 7148 2c15 eed4 d0ab    cc76 
>>>>>> .)...iqH,......v
>>>>>>     0x0020:  5018 ffff 82ac 0000 0000 00a4 ff53 4d42 
>>>>>> P............SMB
>>>>>>     0x0030:  7200 0000 0008 0140 0000 0000 0000 0000 
>>>>>> r......@........
>>>>>>     0x0040:  0000 0000 0000 4006 0000 0100 0081    0002 
>>>>>> ......@.........
>>>>>>     0x0050:  5043 204e 4554 574f 524b 2050 524f 4752 
>>>>>> PC.NETWORK.PROGR
>>>>>>     0x0060:  414d 2031 2e30 0002 4d49 4352 4f53 4f46  AM. 
>>>>>> 1.0..MICROSOF
>>>>>>     0x0070:  5420 4e45 5457 4f52 4b53 2031 2e30 3300   T.NETWORKS. 
>>>>>> 1.03.
>>>>>>     0x0080:  024d 4943 524f 534f 4654 204e 4554    574f 
>>>>>> .MICROSOFT.NETWO
>>>>>>     0x0090:  524b 5320 332e 3000 024c 414e 4d41 4e31  RKS. 
>>>>>> 3.0..LANMAN1
>>>>>>     0x00a0:  2e30 0002 4c4d 312e 3258 3030 3200 0253  . 
>>>>>> 0..LM1.2X002..S
>>>>>>     0x00b0:  616d 6261 0002 4e54 204c 414e 4d41 4e20 
>>>>>> amba..NT.LANMAN.
>>>>>>     0x00c0:  312e 3000 024e 5420 4c4d 2030 2e31 3200   1.0..NT.LM. 
>>>>>> 0.12.
>>>>>> 17:09:18.114348 IP 10.12.0.50.29000 > 172.31.1.48.4201: . ack  169 
>>>>>> win 6432
>>>>>>     0x0000:  4500 0028 999f 4000 4006 4db0 c129 e507  E.. 
>>>>>> (..@[email protected]..)..
>>>>>>     0x0010:  ac1f 0130 7148 1069 d0ab cc76 2c15 ef7c  ... 
>>>>>> 0qH.i...v,..|
>>>>>>     0x0020:  5010 1920 08ce 0000                      P.......
>>>>>> 17:09:18.116709 IP 10.12.0.50.29000 > 172.31.1.48.4201: F  1:1(0) 
>>>>>> ack 169 win 6432
>>>>>>     0x0000:  4500 0028 99a0 4000 4006 4daf c129 e507  E.. 
>>>>>> (..@[email protected]..)..
>>>>>>     0x0010:  ac1f 0130 7148 1069 d0ab cc76 2c15 ef7c  ... 
>>>>>> 0qH.i...v,..|
>>>>>>     0x0020:  5011 1920 08cd 0000                      P.......
>>>>>>
>>>>>> Sincerely,
>>>>>> Michael Zervakis
>>>>>>
>>>>>
>>>>
>>
>