#VU31264 Input validation error in Suricata - CVE-2016-10728


| Updated: 2020-07-17

Vulnerability identifier: #VU31264

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-10728

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Suricata
Server applications / IDS/IPS systems, Firewalls and proxy servers

Vendor: Open Information Security Foundation

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Suricata: 3.1.1

External links
https://github.com/kirillwow/ids_bypass
https://lists.debian.org/debian-lts-announce/2018/09/msg00019.html
https://redmine.openinfosecfoundation.org/issues/1880
https://suricata-ids.org/2016/09/07/suricata-3-1-2-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Input validation error in Suricata