Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-02-07T05:00:00

Updated: 2024-08-05T06:10:11.364Z

Reserved: 2018-02-06T00:00:00

Link: CVE-2018-6794

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2018-02-07T05:29:00.260

Modified: 2019-03-01T23:33:08.113

Link: CVE-2018-6794

cve-icon Redhat

No data.