Описание
An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with random TCP options of the md5header from the client side. After the three-way handshake, it's possible to inject an RST ACK with a random TCP md5header option. Then, the client can send an HTTP GET request with a forbidden URL. The server will ignore the RST ACK and send the response HTTP packet for the client's request. These packets will not trigger a Suricata reject action.
Ссылки
- Release NotesVendor Advisory
- PatchThird Party Advisory
- Release NotesThird Party Advisory
- ExploitIssue TrackingPatchVendor Advisory
- Release NotesVendor Advisory
- PatchThird Party Advisory
- Release NotesThird Party Advisory
- ExploitIssue TrackingPatchVendor Advisory
Уязвимые конфигурации
Одно из
EPSS
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
Связанные уязвимости
An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with random TCP options of the md5header from the client side. After the three-way handshake, it's possible to inject an RST ACK with a random TCP md5header option. Then, the client can send an HTTP GET request with a forbidden URL. The server will ignore the RST ACK and send the response HTTP packet for the client's request. These packets will not trigger a Suricata reject action.
An issue was discovered in Suricata before 6.0.4. It is possible to by ...
An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with random TCP options of the md5header from the client side. After the three-way handshake, it's possible to inject an RST ACK with a random TCP md5header option. Then, the client can send an HTTP GET request with a forbidden URL. The server will ignore the RST ACK and send the response HTTP packet for the client's request. These packets will not trigger a Suricata reject action.
Уязвимость системы обнаружения и предотвращения вторжений Suricata, связанная с недостаточной проверкой хэш-функции, позволяющая нарушителю реализовать атаку TCP Reset
ALT-PU-2022-1180: package `suricata` update to version 6.0.4-alt1
EPSS
7.5 High
CVSS3
5 Medium
CVSS2