OISF Suricata up to 6.0.18/7.0.4 Fragmentation unusual condition

Summaryinfo

A vulnerability, which was classified as problematic, has been found in OISF Suricata up to 6.0.18/7.0.4. This issue affects some unknown processing of the component Fragmentation Handler. Performing a manipulation results in unusual condition. This vulnerability is known as CVE-2024-32867. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in OISF Suricata up to 6.0.18/7.0.4. It has been classified as problematic. This affects an unknown functionality of the component Fragmentation Handler. The manipulation with an unknown input leads to a unusual condition vulnerability. CWE is classifying the issue as CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. This is going to have an impact on integrity. The summary by CVE is:

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, various problems in handling of fragmentation anomalies can lead to mis-detection of rules and policy. This vulnerability is fixed in 7.0.5 or 6.0.19.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-32867 since 04/19/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 6.0.19 or 7.0.5 eliminates this vulnerability. Applying the patch 1e110d0a71db46571040b937e17a4bc9f91d6de9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• OISF

Name

• Suricata

Version

• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7
• 6.0.8
• 6.0.9
• 6.0.10
• 6.0.11
• 6.0.12
• 6.0.13
• 6.0.14
• 6.0.15
• 6.0.16
• 6.0.17
• 6.0.18
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4

License

• open-source

Website

• Product: https://github.com/OISF/suricata/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion