- The NTLM analyzer did not properly handle AV Pair sequences that were
either empty or unterminated, resulting in invalid memory access or
heap buffer over-read. The NTLM analyzer is enabled by default and
used in the analysis of SMB, DCE/RPC, and GSSAPI protocols.
- fixes a security issue in the ContentLine analyzer. In rare cases
a bug in the ContentLine analyzer can lead to an out of bound write of a
single byte. This allows a remote attacker to crash Bro; there also is a
possibility this can be exploited in other ways.
Bro is an open-source, Unix-based Network Intrusion Detection
System (NIDS) that passively monitors network traffic and looks
for suspicious activity.
ok ajacoutot@
