CVE-2018-17019: Improper Input Validation (CWE-20)
value: In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2018-09-13T19:29Z
Repository: https://github.com/bro/bro
Language: Other
Files changed: src/analyzer/protocol/irc/IRC.cc, testing/btest/Baseline/scripts.base.protocols.irc.names-weird/weird.log, testing/btest/scripts/base/protocols/irc/names-weird.bro
Commit date: 2018-09-12 19:47:57 -0500
Commit message: Fix IRC names command parsing

Diff: diff --git a/src/analyzer/protocol/irc/IRC.cc b/src/analyzer/protocol/irc/IRC.cc
index a69674eb50..a46bbb93d6 100644
--- a/src/analyzer/protocol/irc/IRC.cc
+++ b/src/analyzer/protocol/irc/IRC.cc
@@ -250,18 +250,19 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
 				break;
 
 			{
 			vector<string> parts = SplitWords(params, ' ');
 
-			// Remove nick name.
-			parts.erase(parts.begin());
-			if ( parts.size() < 2 )
+			if ( parts.size() < 3 )
 				{
 				Weird("irc_invalid_names_line");
 				return;
 				}
 
+			// Remove nick name.
+			parts.erase(parts.begin());
+
 			string type = parts[0];
 			string channel = parts[1];
 
 			// Remove type and channel.
 			parts.erase(parts.begin());
diff --git a/testing/btest/Baseline/scripts.base.protocols.irc.names-weird/weird.log b/testing/btest/Baseline/scripts.base.protocols.irc.names-weird/weird.log
new file mode 100644
index 0000000000..908df6470e
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.irc.names-weird/weird.log
@@ -0,0 +1,10 @@
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	weird
+#open	2018-09-13-00-31-10
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	name	addl	notice	peer
+#types	time	string	addr	port	addr	port	string	string	bool	string
+1536797872.428637	ClEkJM2Vm5giqnMf4h	127.0.0.1	65389	127.0.0.1	6666	irc_invalid_names_line	-	F	bro
+#close	2018-09-13-00-31-10
diff --git a/testing/btest/Traces/irc-353.pcap b/testing/btest/Traces/irc-353.pcap
new file mode 100644
index 0000000000..61d12bffab
Binary files /dev/null and b/testing/btest/Traces/irc-353.pcap differ
diff --git a/testing/btest/scripts/base/protocols/irc/names-weird.bro b/testing/btest/scripts/base/protocols/irc/names-weird.bro
new file mode 100644
index 0000000000..33124416f6
--- /dev/null
+++ b/testing/btest/scripts/base/protocols/irc/names-weird.bro
@@ -0,0 +1,7 @@
+# @TEST-EXEC: bro -C -r $TRACES/irc-353.pcap %INPUT
+# @TEST-EXEC: btest-diff weird.log
+
+event irc_names_info(c: connection, is_orig: bool, c_type: string, channel: string, users: string_set)
+	{
+	print channel, users;
+	}

Vulnerable code: 			// Remove nick name.
			parts.erase(parts.begin());
			if ( parts.size() < 2 )
Fixed code: 			if ( parts.size() < 3 )
			// Remove nick name.
			parts.erase(parts.begin());

#separator \x09
#set_separator	,
#empty_field	(empty)
#unset_field	-
#path	weird
#open	2018-09-13-00-31-10
#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	name	addl	notice	peer
#types	time	string	addr	port	addr	port	string	string	bool	string
1536797872.428637	ClEkJM2Vm5giqnMf4h	127.0.0.1	65389	127.0.0.1	6666	irc_invalid_names_line	-	F	bro
#close	2018-09-13-00-31-10
# @TEST-EXEC: bro -C -r $TRACES/irc-353.pcap %INPUT
# @TEST-EXEC: btest-diff weird.log

event irc_names_info(c: connection, is_orig: bool, c_type: string, channel: string, users: string_set)
	{
	print channel, users;
	}