Suricata 8.0.1 and 7.0.12 Fix Detection Bypass and Crash Vulnerabilities
· 55:55 · Watch on YouTube ↗
Summary
Suricata team members explain security fixes in versions 8.0.1 and 7.0.12, including a TCP reassembly bypass and several crash conditions, and recommend upgrading sensors.
Key points
- Multiple TCP SYN packets with different sequence numbers could disrupt reassembly, potentially bypassing detection and logging in IDS mode.
- In IPS mode, affected flows may be blocked depending on exception policies. The speakers recommend upgrading as the primary fix.
- Suricata 8 rules using an unbounded entropy keyword could trigger a null pointer dereference; disabling those rules is an alternative workaround.
- An LDAP rule keyword combined with a transform could cause a stack-based buffer overflow during startup or rule reload in Suricata 8.
- A TLS subject alternative name rule could trigger a crash when the certificate field is present but empty; disabling affected rules is an alternative workaround.
- The speakers say minor-version upgrades are intended to preserve compatibility, while moving from version 7 to 8 requires planning and may require configuration changes.
Article Details
- Topics
- [05:32] Suricata network analysis and threat detection
- [09:39] Vulnerability disclosure and patch release process
- [18:35] Impact of Suricata crashes and upgrade considerations
- [25:11] TCP reassembly bypass and mitigation
- [35:41] Entropy keyword crash condition
- [37:25] LDAP rule keyword buffer overflow
- [40:27] TLS subject alternative name crash condition
- [51:39] Suricata rule-writing resources and offline PCAP analysis
People
Dr Josh StroscheinHosts the security discussion and asks about vulnerability impacts and upgrade practices.Lucas SysmusExplains the vulnerabilities fixed in the Suricata releases and recommended mitigations.Peter ManovDiscusses Suricata security releases, patching practices and vulnerability disclosure.