Zeek

Thank you to Jan Grashöfer (@J-Gras), h4r4kIR1, Javid Khan (@dxbjavid), @jmestwa-coder,

and @uwezkhan for their contributions to this release.

This release fixes the following security issues:

• HIGH: The NVT, Rlogin, and RSH analyzers have received fixes to avoid unbounded state

growth. Due to the fact that these packets can be received from remote hosts, these are

considered DoS risks. The fixes include additional length-checking when processing

packets, as well as a new set of weirds for when the standard Content-Line limits are

exceeded.

• HIGH: A specially crafted WebSocket payload can cause the Spicy WebSocket analyzer to

use excessive memory when processing close, ping, and pong frames. Due to the fact that

these packets can be received from remote hosts, these are considered a DoS risk. The

fix caps the size of those frames as per RFC 6455 (to 125 bytes) and adds a new weird

for when that limit is exceeded.

• HIGH: A specially crafted series of Finger packets can cause the Spicy Finger analyzer

to use excessive amounts of memory and potentially crash Zeek. Due to the fact that

these packets can be received from remote hosts, this is considered a DoS risk. The fix

includes a new Finger::max_line_length script constant. Spicy will report protocol

violations if this limit is exceeded.

• HIGH: A specially crafted Kerberos packet can cause the Kerberos analyzer to enter an

invalid state and potentially crash Zeek. Due to the fact that these packets can be

received from remote hosts, this is considered a DoS risk. The fix includes additional

checks for the state reported by the Kerberos packets.

• HIGH: A specially crafted series of RDP packets can cause the RDP analyzer to use

excessive amounts of memory and potentially crash Zeek. Due to the fact that these

packets can be received from remote hosts, this is considered a DoS risk. The fix

includes a new rpc_max_pending_calls script constant. If this limit is exceeded, a

new rpc_discarded_pending_calls event is emitted and a weird is reported.

• HIGH: A specially crafted IP packet can cause the IP analyzer to read past the end of

the contents of the packet when emitting the packet_contents event and possibly

crash. Due to the fact that these packets can be received from remote hosts, this is

considered a DoS risk. The fix changes how Zeek checks the remaining length of the

packet when emitting the event. The packet_contents event typically isn't used in

production setups.

• HIGH: A specially crafted IP packet can cause the packet discarding code to read off the

end of the packet when looking for follow-on header data. This may potentially lead to a

crash of Zeek. Due to the fact that these packets can be received from remote hosts,

this is considered a DoS risk. Note that this only applies if the user enables the

discarder by implementing one of the discarder_check_* script functions. The fix

includes additional length checks to the IP_HDr::ToPktHdrVal method to skip looking

for additional headers if there isn’t enough data.

• HIGH: A specially crafted series of Gnutella packets may cause Zeek to continue

accumulating memory and eventually crash. Due to the fact that these packets can be

received from remote hosts, this is considered a DoS risk. Note that the Gnutella

analyzer is disabled by default. The fix includes new Gnutella::max_line_length and

Gnutella::max_header_length script constant values to control the maximum size of data

processed, as well as new weirds for when the limits are exceeded.

• MEDIUM: A specially crafted ICMPv6 packet can cause the ICMP analyzer to skip part of

the packet and not report corresponding events and logs. Due to the fact that these

packets can be received from remote hosts, this is considered an evasion risk. The fix

includes additional length-checking and five new weirds to c

<h1 align="center">

Zeek Logo

The Zeek Network Security Monitor

</h1><h4 align="center">

A powerful framework for network

traffic analysis and security monitoring.

_Key Features_ —

_Documentation_ —

_Getting Started_ —

_Development_ —

_License_

Coverage Status

Build Status

Slack

Discourse

Mastodon

Bluesky

</h4>

Key Features

---

• __In-depth Analysis__

Zeek ships with analyzers for many protocols, enabling high-level semantic

analysis at the application layer.

• __Adaptable and Flexible__

Zeek's domain-specific scripting language enables site-specific monitoring

policies and means that it is not restricted to any particular detection

approach.

• __Efficient__

Zeek targets high-performance networks and is used operationally at a variety

of large sites.

• __Highly Stateful__

Zeek keeps extensive application-layer state about the network it monitors

and provides a high-level archive of a network's activity.

Getting Started

---

The best place to find information about getting started with Zeek is

our web site www.zeek.org, specifically the

documentation section

there. On the web site you can also find downloads for stable

releases, tutorials on getting Zeek set up, and many other useful

resources.

You can find release notes in NEWS,

and a complete record of all changes in CHANGES.

To work with the most recent code from the development branch of Zeek,

clone the master git repository:

git clone --recursive https://github.com/zeek/zeek

With all dependencies

in place, build and install:

./configure && make && sudo make install

Write your first Zeek script:

# File "hello.zeek"

event zeek_init()
    {
    print "Hello World!";
    }

And run it:

zeek hello.zeek

For learning more about the Zeek scripting

language, try.zeek.org is a great resource.

Development

---

Zeek is developed on GitHub by its community. We welcome

contributions. Working on an open source project like Zeek can be an

incredibly rewarding experience and, packet by packet, makes the

Internet a little safer. Today, as a result of countless

contributions, Zeek is used operationally around the world by major

companies and educational and scientific institutions alike for

securing their cyber infrastructure.

If you're interested in getting involved, we collect feature requests

and issues on GitHub here and

you might find

these

to be a good place to get started. More information on Zeek's

development can be found

here, and information

about its community and mailing lists (which are fairly active) can be

found here.

License

---

Zeek comes with a BSD license, allowing for free use with virtually no

restrictions. You can find it here.

Tooling

---

We use the following tooling to help discover issues to fix, amongst a number of

others.

• Clang-Tidy
• Coverity
• PVS-Studio - static analyzer for C, C++, C#, and Java code.