Victor Julien

**Name of the Vulnerable Software and Affected Versions** Suricata versions 8.0.0 through 8.0.2 **Description** Suricata, a network IDS, IPS and NSM engine, is susceptible to a stack overflow that can cause the software to crash. This issue affects versions starting from 8.0.0 and prior to 8.0.3. As a temporary measure, utilizing default values for the `request-body-limit` and `response-body-limit` parameters can mitigate the issue. **Recommendations** Update to Suricata version 8.0.3 or later. As a temporary workaround, use default values for the `request-body-limit` and `response-body-limit` parameters.

Name of the Vulnerable Software and Affected Versions: Suricata versions prior to 7.0.6 Description: A memory allocation failure due to `http.memcap` being reached leads to a NULL-ptr reference, resulting in a crash. This issue can be exploited by a remote attacker to cause a denial of service. Recommendations: For versions prior to 7.0.6, upgrade to 7.0.6 to resolve the issue. As a temporary workaround, consider adjusting the `http.memcap` setting to prevent the memory allocation failure until a patch is applied. Restrict access to the Suricata engine to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Suricata version 5.0.0 **Description** An issue was discovered in Suricata that allows an attacker to bypass or evade any TCP-based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet, which contains the data to be bypassed. Suricata ignores the PUSH ACK packet because it overlaps the FIN packet, which has identical sequence and ACK numbers. The client ignores the fake FIN packet because the ACK flag is not set. Both Linux and Windows clients ignore the injected packet. **Recommendations** For Suricata version 5.0.0, consider disabling the TCP signature detection until a patch is available, as a temporary workaround to minimize the risk of exploitation. Restrict access to the Suricata system to prevent remote attackers from injecting fake FIN packets. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Suricata version 5.0.0 **Description** A problem was discovered in Suricata where it is possible to bypass or evade any TCP-based signature by faking a closed TCP session using a malicious server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the RST ACK and FIN ACK packets due to the bad TCP Timestamp option. Both Linux and Windows clients are ignoring the injected packets. **Recommendations** For Suricata version 5.0.0, as a temporary workaround, consider disabling the TCP signature checking until a patch is available. Restrict access to the Suricata system to minimize the risk of exploitation. Avoid using the TCP protocol with a bad TCP Timestamp option in the affected system until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Suricata versions 4.0.0 through 4.0.5 **Description** The issue allows remote attackers to cause a denial of service, resulting in a segfault and daemon crash, via crafted input to the SMTP parser. This has been exploited in the wild. **Recommendations** For Suricata versions 4.0.0 through 4.0.5, update to version 4.0.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Suricata versions prior to 3.1.2 **Description** An issue was discovered where receiving an ICMPv4 error packet as the first packet on a flow in the to client direction confuses the rule grouping lookup logic. This causes the toclient inspection to continue with the wrong rule group, potentially leading to missed detection. **Recommendations** For versions prior to 3.1.2, update to version 3.1.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Suricata versions prior to 3.2.1 **Description** The issue is caused by a lack of a check for the IP protocol during fragment matching, leading to an IPv4 defragmentation evasion problem. **Recommendations** For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Suricata versions prior to 2.0.6 **Description** The issue is related to the MemcmpLowercase function, which improperly excludes the first byte from comparisons. This might allow remote attackers to bypass intrusion-prevention functionality via a crafted HTTP request. **Recommendations** For versions prior to 2.0.6, update to version 2.0.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 2.6.22 **Description** The issue is related to the improper validation of the hop-by-hop IPv6 extended header in the `ipv6 hop jumbo` function. This allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and kernel panic, via a crafted IPv6 packet. **Recommendations** For versions prior to 2.6.22, update to version 2.6.22 or later to resolve the issue.