Wireshark-bugs: [Wireshark-bugs] [Bug 12473] New: SMB NtCreate andX with extended response somet
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 26 May 2016 01:46:43 +0000
Bug ID 12473
Summary SMB NtCreate andX with extended response sometimes incorrect
Product Wireshark
Version Git
Hardware x86
OS Windows 7
Status UNCONFIRMED
Severity Major
Priority Low
Component Dissection engine (libwireshark)
Assignee bugzilla-admin@wireshark.org
Reporter gordon.w.ross@gmail.com 

Build Information:
as of commit 66417b17b3570b163a16ca81f71ce5bcb10548d2
--
The decoded for SMB NtCreate andX only handles the extended response if it can
find the flags field from the matching request.  This is incorrect because the
server might not support that flag, in which case the server will ignore the
flag and send a normal 34 word response.
In short, the only way to know which kind of response you're decoding is to
look at the word count.

You are receiving this mail because:
  • You are watching all bug changes.