CVE-2019-18792

An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by Suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets). The client will ignore the fake FIN packet because the ACK flag is not set. Both linux and windows clients are ignoring the injected packet.

CVSS v3.0 9.1 CRITICAL
CVSS v2.0 6.4 MEDIUM

9.1^/10

CVSS v3.0 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/OISF/suricata/commit/1c63d3905852f746ccde7e2585600b2199cefb4b	Patch Third Party Advisory
https://redmine.openinfosecfoundation.org/issues/3324	Exploit Third Party Advisory
https://redmine.openinfosecfoundation.org/issues/3394	Exploit Third Party Advisory
https://github.com/OISF/suricata/commit/fa692df37a796c3330c81988d15ef1a219afc006	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00032.html	Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:suricata-ids:suricata::::::::
	cpe:2.3:a:suricata-ids:suricata:5.0.0:::::::*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Information

Published : 2020-01-06 10:15

Updated : 2021-07-21 04:39

NVD link : CVE-2019-18792

Mitre link : CVE-2019-18792

JSON object : View

CWE

CWE-436

Interpretation Conflict

Advertisement

Products Affected

debian

debian_linux

suricata-ids

suricata

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/OISF/suricata/commit/1c63d3905852f746ccde7e2585600b2199cefb4b", "name": "https://github.com/OISF/suricata/commit/1c63d3905852f746ccde7e2585600b2199cefb4b", "tags": ["Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://redmine.openinfosecfoundation.org/issues/3324", "name": "https://redmine.openinfosecfoundation.org/issues/3324", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://redmine.openinfosecfoundation.org/issues/3394", "name": "https://redmine.openinfosecfoundation.org/issues/3394", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/OISF/suricata/commit/fa692df37a796c3330c81988d15ef1a219afc006", "name": "https://github.com/OISF/suricata/commit/fa692df37a796c3330c81988d15ef1a219afc006", "tags": ["Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00032.html", "name": "[debian-lts-announce] 20200130 [SECURITY] [DLA 2087-1] suricata security update", "tags": ["Third Party Advisory"], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by Suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets). The client will ignore the fake FIN packet because the ACK flag is not set. Both linux and windows clients are ignoring the injected packet."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-436"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-18792", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}}, "publishedDate": "2020-01-06T18:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:suricata-ids:suricata:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "4.1.6", "versionStartIncluding": "4.1.5"}, {"cpe23Uri": "cpe:2.3:a:suricata-ids:suricata:5.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2021-07-21T11:39Z"}