What functions and functionality is relevant?

The dissect_netb_terminate_trace function contained within epan/dissectors/packet-netbios.c is relevant.

Why is this vulnerable?

The dissector allocates a buffer to convert the signature into a string to display in the parsed GUI output. If an attacker supplies a string that is too long a heap-based buffer overflow can occur.

Is this a replay and/or is inspired by anything?

This was inspired by historical wireshark vulnerabilities, some of which included unchecked copies that resulted in code execution.

What makes it interesting?

While there are some bounds checking around the string copy, they are insufficient to mitigate the vulnerability and a CRS will need to understand that to properly flag that this code is vulnerable.

Additional Information, 🧩 What is NetBIOS?

NetBIOS (Network Basic Input/Output System) is a legacy API developed in the 1980s that provides communication services over a local area network (LAN). While originally designed for small networks using the NetBEUI protocol, it was later adapted to run over TCP/IP (commonly referred to as NetBIOS over TCP/IP or NBT). NetBIOS supports name registration and resolution, session management, and datagram communication.

Despite being largely obsolete in modern systems, it still exists for backward compatibility in Windows networks and some embedded environments.

📦 NetBIOS Commands

NetBIOS defines a number of commands that represent different types of messages or operations in its protocol. These are typically exchanged between hosts to manage sessions, transfer data, or resolve names.

Each command has its own structure and set of fields, often including session IDs, flags, and embedded NetBIOS names.

🧾 NetBIOS Packet Format (Session Layer)

Command Code	Command Name	Description
`0x00`	Add Group Name	Register a group name on the network
`0x01`	Add Name	Register a unique name
`0x0A`	Name Query	Request address info for a NetBIOS name
`0x0D`	Add Name Response	Reply to an Add Name request
`0x0E`	Name Recognized (Response)	Acknowledge that a name has been recognized
`0x08`	Datagram	Send a connectionless message
`0x14`	Data Acknowledge	Acknowledge received session data
`0x15`	Data First/Middle	Start or continue a fragmented session message
`0x16`	Data Only/Last	Send an unfragmented or final fragment of session data
`0x19`	Session Initialize	Begin a NetBIOS session between peers
`0x1F`	Keep Alive	Ensure the session is still valid

+---------------------+---------------------+
| Offset              | Field               |
+---------------------+---------------------+
| 0x00 (2 bytes)      | Length              |
| 0x02 (2 bytes)      | Delimiter (0xEFFF)  |
| 0x04 (1 byte)       | Command             |
| 0x05 (1 byte)       | Flags               |
| 0x06 (1 byte)       | Data1               |
| 0x07 (1 byte)       | Data2               |
| 0x08 (2 bytes)      | Transmit Correlator |
| 0x0A (2 bytes)      | Response Correlator |
| 0x0C (1 byte)       | Remote Session No.  |
| 0x0D (1 byte)       | Local Session No.   |
| 0x0E–0x1D (16 bytes)| Receiver Name       |
| 0x1E–0x2D (16 bytes)| Sender Name         |
| ...                 | Command-specific    |
|                     | Payload             |
+---------------------+---------------------+

🧠 Notes

The “TERMINATE_TRACE” command in NetBIOS is used to end an active diagnostic trace on a remote node. This command is part of the Diagnostic and Monitoring Protocol (DMP) within the NetBIOS suite.

🔧 Purpose

The primary function of the “TERMINATE_TRACE” command is to instruct a remote node to stop its ongoing trace operationThis is typically used after a trace has been initiated to monitor network activity or troubleshoot issues, allowing administrators to conclude the trace once sufficient data has been collected

📦 Packet Structure

According to documentation, the “TERMINATE_TRACE” frame has the following structur:

📚 References

These references provide detailed information on NetBIOS commands and their implementatios.

🧾 TERMINATE_TRACE Packet Format

📋 Field Details

🔧 Flags (1 byte)

🎯 Reason Code (1 byte)

📎 Signature

🧠 Design Notes