PT-2017-3436 · Open Information Security Foundation · Suricata

Ajaxtpm + 1 · Published 2017-10-13 · Updated 2020-10-27 · CVE-2017-15377

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 4.x

Description The issue is related to the DetectEngineContentInspection component in Suricata, which can be triggered by crafted network traffic with a certain signature. This causes the search engine to perform redundant checks on the content, leading to potential denial of service. The search engine fails to stop when it should after no match is found, instead stopping only upon reaching the inspection-recursion-limit, which is 3000 by default. An attacker could exploit this to cause a denial of service using specially crafted network traffic, resulting in excessive checks.

Recommendations For Suricata versions prior to 4.x, consider updating to version 4.x or later to resolve the issue. As a temporary workaround, consider adjusting the inspection-recursion-limit to a lower value to minimize the risk of exploitation. Restrict access to the DetectEngineContentInspection component to minimize the risk of denial of service attacks.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2018-00261

CVE-2017-15377

DLA-1603-1

Affected Products

Suricata

References · 23

• https://redmine.openinfosecfoundation.org/issues/2231 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15377 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00261 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15377 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15377 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1603-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1603-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7177 · Security Note
• https://security-tracker.debian.org/tracker/source-package/suricata · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00358 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15377 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15377 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15377 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6794 · Security Note