suricata-ids Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/suricata-ids/ Sun, 26 Feb 2023 06:50:49 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png suricata-ids Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/suricata-ids/ 32 32 CVE-2018-6794 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-6794/ Sun, 26 Feb 2023 06:50:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-6794/ Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI […]

The post CVE-2018-6794 appeared first on CVE Vulnerability.

]]> Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.

The post CVE-2018-6794 appeared first on CVE Vulnerability.

]]> CVE-2018-18956 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-18956/ Sun, 26 Feb 2023 06:47:59 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-18956/ The ProcessMimeEntity function in util-decode-mime.c in Suricata 4.x before 4.0.6 allows remote attackers to cause a denial of service (segfault and daemon crash) via crafted input to the SMTP parser, as exploited in the wild in November 2018.

The post CVE-2018-18956 appeared first on CVE Vulnerability.

]]> The ProcessMimeEntity function in util-decode-mime.c in Suricata 4.x before 4.0.6 allows remote attackers to cause a denial of service (segfault and daemon crash) via crafted input to the SMTP parser, as exploited in the wild in November 2018.

The post CVE-2018-18956 appeared first on CVE Vulnerability.

]]> CVE-2018-14568 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-14568/ Sun, 26 Feb 2023 06:46:22 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-14568/ Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. This allows detection bypass because Windows TCP clients proceed with normal processing of TCP data that arrives shortly after an RST (i.e., they act as if the RST had not yet been received).

The post CVE-2018-14568 appeared first on CVE Vulnerability.

]]> Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. This allows detection bypass because Windows TCP clients proceed with normal processing of TCP data that arrives shortly after an RST (i.e., they act as if the RST had not yet been received).

The post CVE-2018-14568 appeared first on CVE Vulnerability.

]]> CVE-2018-10244 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-10244/ Sun, 26 Feb 2023 06:44:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-10244/ Suricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. A malformed PDU can cause the parsing code to read beyond the allocated data because DecodeENIPPDU in app-layer-enip-commmon.c has an integer overflow during a length check.

The post CVE-2018-10244 appeared first on CVE Vulnerability.

]]> Suricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. A malformed PDU can cause the parsing code to read beyond the allocated data because DecodeENIPPDU in app-layer-enip-commmon.c has an integer overflow during a length check.

The post CVE-2018-10244 appeared first on CVE Vulnerability.

]]> CVE-2018-10242 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-10242/ Sun, 26 Feb 2023 06:44:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-10242/ Suricata version 4.0.4 incorrectly handles the parsing of the SSH banner. A malformed SSH banner can cause the parsing code to read beyond the allocated data because SSHParseBanner in app-layer-ssh.c lacks a length check.

The post CVE-2018-10242 appeared first on CVE Vulnerability.

]]> Suricata version 4.0.4 incorrectly handles the parsing of the SSH banner. A malformed SSH banner can cause the parsing code to read beyond the allocated data because SSHParseBanner in app-layer-ssh.c lacks a length check.

The post CVE-2018-10242 appeared first on CVE Vulnerability.

]]> CVE-2019-18792 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-18792/ Sun, 26 Feb 2023 06:31:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-18792/ An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by Suricata because […]

The post CVE-2019-18792 appeared first on CVE Vulnerability.

]]> An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by Suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets). The client will ignore the fake FIN packet because the ACK flag is not set. Both linux and windows clients are ignoring the injected packet.

The post CVE-2019-18792 appeared first on CVE Vulnerability.

]]> CVE-2019-18625 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-18625/ Sun, 26 Feb 2023 06:31:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-18625/ An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the […]

The post CVE-2019-18625 appeared first on CVE Vulnerability.

]]> An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the RST ACK and the FIN ACK packets because of the bad TCP Timestamp option. Both linux and windows client are ignoring the injected packets.

The post CVE-2019-18625 appeared first on CVE Vulnerability.

]]> CVE-2019-17420 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-17420/ Sun, 26 Feb 2023 06:31:34 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-17420/ In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single rn ending.

The post CVE-2019-17420 appeared first on CVE Vulnerability.

]]> In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single rn ending.

The post CVE-2019-17420 appeared first on CVE Vulnerability.

]]> CVE-2019-16411 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-16411/ Sun, 26 Feb 2023 06:31:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-16411/ An issue was discovered in Suricata 4.1.4. By sending multiple IPv4 packets that have invalid IPv4Options, the function IPV4OptValidateTimestamp in decode-ipv4.c tries to access a memory region that is not allocated. There is a check for o->len data + 3)” places one beyond the 3 bytes, because the code should have been “flag = *(o->data […]

The post CVE-2019-16411 appeared first on CVE Vulnerability.

]]> An issue was discovered in Suricata 4.1.4. By sending multiple IPv4 packets that have invalid IPv4Options, the function IPV4OptValidateTimestamp in decode-ipv4.c tries to access a memory region that is not allocated. There is a check for o->len data + 3)” places one beyond the 3 bytes, because the code should have been “flag = *(o->data + 1)” instead.

The post CVE-2019-16411 appeared first on CVE Vulnerability.

]]> CVE-2019-16410 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-16410/ Sun, 26 Feb 2023 06:31:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-16410/ An issue was discovered in Suricata 4.1.4. By sending multiple fragmented IPv4 packets, the function Defrag4Reassemble in defrag.c tries to access a memory region that is not allocated, because of a lack of header_len checking.

The post CVE-2019-16410 appeared first on CVE Vulnerability.

]]> An issue was discovered in Suricata 4.1.4. By sending multiple fragmented IPv4 packets, the function Defrag4Reassemble in defrag.c tries to access a memory region that is not allocated, because of a lack of header_len checking.

The post CVE-2019-16410 appeared first on CVE Vulnerability.

]]>