CVE-2017-15377 In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engin...
HighCVSS 7.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engine doesn't stop when it should after no match is found; instead, it stops only upon reaching inspection-recursion-limit (3000 by default).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/suricata(Debian:13) | < 1:4.0.0-1 | 1:4.0.0-1 |
| debian/suricata(Debian:14) | < 1:4.0.0-1 | 1:4.0.0-1 |
| openinfosecfoundation suricata | <= 3.2.4 | No fix listed |
References
- Debian Security Tracker CVE-2017-15377 vendor-advisory
- github.com
- [debian-lts-announce] 20181204 [SECURITY] [DLA 1603-1] suricata security update mailing-list
- redmine.openinfosecfoundation.org vendor-advisory