Detections
Analytics
Suricata < 7.0.8 Multiple Vulnerabilities
high Nessus Plugin ID 214272
Language:
Synopsis
An IDS/IPS solution running on the remote host is affected by multiple vulnerabilities.Description
The version of OISF Suricata installed on the remote host is prior to 6.0.19 or 7.x prior to 7.0.5. It is, therefore, affected by multiple vulnerabilities:- A large input buffer to one of the following transforms can lead to a stack overflow causing Suricata to crash in the following transforms: to_lowercase, to_uppercase, strip_whitespace, compress_whitespace, dotprefix, header_lowercase, strip_pseudo_headers, url_decode, xor (CVE-2024-55605)
- A large BPF filter file provided to Suricata at startup can lead to a buffer overflow at Suricata startup. (CVE-2024-55626)
- A specially crafted TCP stream can lead to a very large buffer overflow while being zero-filled during initialization with memset due to an unsigned integer underflow. (CVE-2024-55627)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade Suricata to 7.0.8 or higher.See Also
http://www.nessus.org/u?16b5d78a
http://www.nessus.org/u?ccb23e05
http://www.nessus.org/u?77fb895c
http://www.nessus.org/u?6251896c
Plugin Details
Severity: High
ID: 214272
File Name: suricata_7_0_8.nasl
Version: 1.3
Type: local
Agent: windows, macosx, unix
Family: Misc.
Published: 1/16/2025
Updated: 1/23/2025
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2024-55605
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2024-55629
Vulnerability Information
CPE: cpe:/a:oisf:suricata
Required KB Items: installed_sw/Open Information Security Foundation Suricata
Exploit Ease: No known exploits are available
Patch Publication Date: 12/12/2024
Vulnerability Publication Date: 1/6/2025
Reference Information
CVE: CVE-2024-55605, CVE-2024-55626, CVE-2024-55627, CVE-2024-55628, CVE-2024-55629