PT-2019-11407 · Open Information Security Foundation · Suricata

Published 2019-08-28 · Updated 2021-07-21 · CVE-2019-10056

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Suricata version 4.1.3

Description: The issue arises from the mishandling of network packets in the DecodeEthernet function, specifically when a packet is sent with the right type, causing the function to execute twice. This leads to the algorithm cutting the first part of the packet and failing to determine its current length. For instance, a packet exactly 28 bytes long is processed incorrectly, resulting in a crash when the program attempts to cast the packet without a type.

Recommendations: For Suricata version 4.1.3, consider updating to a newer version that addresses this issue, as the current version's handling of specific network packet types can lead to a crash. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-10056

Affected Products

Suricata

References · 9

• 🔥 https://redmine.openinfosecfoundation.org/issues/2946 · Exploit
• https://suricata-ids.org/2019/04/30/suricata-4-1-4-released · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10056 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10056 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10056 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10056 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10056 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10056 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10056 · Vendor Advisory