PT-2020-6917 · Suricata · Suricata

Victor Julien · Published 2020-01-06 · Updated 2024-10-22 · CVE-2019-18792

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Suricata version 5.0.0

Description An issue was discovered in Suricata that allows an attacker to bypass or evade any TCP-based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet, which contains the data to be bypassed. Suricata ignores the PUSH ACK packet because it overlaps the FIN packet, which has identical sequence and ACK numbers. The client ignores the fake FIN packet because the ACK flag is not set. Both Linux and Windows clients ignore the injected packet.

Recommendations For Suricata version 5.0.0, consider disabling the TCP signature detection until a patch is available, as a temporary workaround to minimize the risk of exploitation. Restrict access to the Suricata system to prevent remote attackers from injecting fake FIN packets. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-436

Related Identifiers

BDU:2023-06877

CVE-2019-18792

DLA-2087-1

Affected Products

Suricata

References · 15

• 🔥 https://redmine.openinfosecfoundation.org/issues/3394 · Exploit
• 🔥 https://redmine.openinfosecfoundation.org/issues/3324 · Exploit
• https://github.com/OISF/suricata/commit/fa692df37a796c3330c81988d15ef1a219afc006 · Patch
• https://github.com/OISF/suricata/commit/1c63d3905852f746ccde7e2585600b2199cefb4b · Patch
• https://cve.org/CVERecord?id=CVE-2019-18792 · Security Note
• https://bdu.fstec.ru/vul/2023-06877 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18792 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18792 · Security Note
• https://osv.dev/vulnerability/DLA-2087-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-18792 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18792 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-18792 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18792 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/01/msg00032.html · Note
• https://t.me/cvenotify/99115 · Telegram Post