PT-2018-1050 · Open Information Security Foundation+1 · Suricata+1

Kirill Shipulin + 1 · Published 2018-01-25 · Updated 2021-06-24 · CVE-2018-6794

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 4.0.4

Description The issue allows a malicious server to bypass HTTP detection by sending data before the 3-way handshake is complete, which can be accepted by web clients but ignored by Suricata IDS signatures. This primarily affects IDS signatures for the HTTP protocol and TCP stream content.

Recommendations For Suricata versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the detect.c and stream-tcp.c components until a patch is available.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-435

CWE-693

Related Identifiers

ALT-PU-2020-3551

ALT-PU-2021-2056

BDU:2018-00358

CVE-2018-6794

DLA-1603-1

Affected Products

Alt Linux

Suricata

References · 34

• 🔥 https://github.com/kirillwow/ids_bypass · Exploit
• 🔥 https://exploit-db.com/exploits/44247 · Exploit
• https://github.com/OISF/suricata/pull/3202/commits/e1ef57c848bbe4e567d5d4b66d346a742e3f77a1 · Patch
• https://cve.org/CVERecord?id=CVE-2018-6794 · Security Note
• https://bdu.fstec.ru/vul/2018-00261 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6794 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010251 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1603-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2021-2056 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1603-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7177 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010279 · Security Note
• https://bdu.fstec.ru/vul/2018-00358 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15377 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14568 · Security Note