OISF Suricata up to 7.0.7 TCP Endpoint incomplete model of endpoint features

Summaryinfo

A vulnerability marked as problematic has been reported in OISF Suricata up to 7.0.7. The affected element is an unknown function of the component TCP Endpoint. This manipulation causes incomplete model of endpoint features. The identification of this vulnerability is CVE-2024-55629. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in OISF Suricata up to 7.0.7. It has been declared as problematic. Affected by this vulnerability is an unknown code of the component TCP Endpoint. The manipulation with an unknown input leads to a incomplete model of endpoint features vulnerability. The CWE definition for the vulnerability is CWE-437. A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model. As an impact it is known to affect integrity. The summary by CVE is:

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.8, TCP streams with TCP urgent data (out of band data) can lead to Suricata analyzing data differently than the applications at the TCP endpoints, leading to possible evasions. Suricata 7.0.8 includes options to allow users to configure how to handle TCP urgent data. In IPS mode, you can use a rule such as drop tcp any any -> any any (sid:1; tcp.flags:U*;) to drop all the packets with urgent flag set.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-55629 since 12/09/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 231962 (Linux Distros Unpatched Vulnerability : CVE-2024-55629), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 7.0.8 eliminates this vulnerability. Applying the patch 6882bcb3e51bd3cf509fb6569cc30f48d7bb53d7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (231962). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• OISF

Name

• Suricata

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7

License

• open-source

Website

• Product: https://github.com/OISF/suricata/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion