PT-2018-1050 · Open Information Security Foundation+1 · Suricata+1

Kirill Shipulin + 1 · Publicado 2018-01-25 · Atualizado 2021-06-24 · CVE-2018-6794

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 4.0.4

Description The issue allows a malicious server to bypass HTTP detection by sending data before the 3-way handshake is complete, which can be accepted by web clients but ignored by Suricata IDS signatures. This primarily affects IDS signatures for the HTTP protocol and TCP stream content.

Recommendations For Suricata versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the detect.c and stream-tcp.c components until a patch is available.

Exploit

Correção

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-435

CWE-693

Identificadores relacionados

ALT-PU-2020-3551

ALT-PU-2021-2056

BDU:2018-00358

CVE-2018-6794

DLA-1603-1

Produtos afetados

Alt Linux

Suricata

Referências · 34

• 🔥 https://github.com/kirillwow/ids_bypass · Exploit
• 🔥 https://exploit-db.com/exploits/44247 · Exploit
• https://github.com/OISF/suricata/pull/3202/commits/e1ef57c848bbe4e567d5d4b66d346a742e3f77a1 · Correção
• https://cve.org/CVERecord?id=CVE-2018-6794 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00261 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6794 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010251 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DLA-1603-1 · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2021-2056 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-1603-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7177 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2018-6794 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010279 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00358 · Nota de Segurança
• https://packages.debian.org/src:suricata · Nota