Skip to content

Conversation

msutovsky-r7
Copy link
Contributor

This PR fixes #20183. The problematic code was present in lib/rex/proto/smb/simple_client.rb file, where SMB version negotiation is present:

[snipped]
        dlog("SMB version(s) to negotiate: #{self.versions}")
        ok = self.client.negotiate
        dlog("Negotiated SMB version: SMB#{negotiated_smb_version}")
  
        if self.client.is_a?(RubySMB::Client)
          self.server_max_buffer_size = self.client.server_max_buffer_size
        else
          self.server_max_buffer_size = ok['Payload'].v['MaxBuff']
        end
[snipped]

The ok variable is not checked in any way and so it the negotiation fails for some reason and ok is nil, then ok['Payload'] will fail and crash the module.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Status: Todo
Development

Successfully merging this pull request may close these issues.

fuzzers/smb/smb_create_pipe_corrupt crashes on start
1 participant