Security #1278: ssh banner parsing issue - Suricata - Open Information Security Foundation

Actions

Copy link

Security #1278

closed

ssh banner parsing issue

Added by Victor Julien over 9 years ago. Updated over 3 years ago.

Status:

Closed

Priority:

High

Assignee:

Victor Julien

Target version:

2.0.4

Affected Versions:

Label:

CVE:

2014-6603

Git IDs:

8ec28dea16080c77828412d6de01018dabc7b7c3

Severity:

Disclosure Date:

Description

Reported privately.

Actions

Copy link

Updated by Victor Julien over 9 years ago

Subject changed from ssh issue to ssh banner parsing issue
Priority changed from Normal to High

    app-layer-ssh: fix banner parser

    Carefully crafted SSH banner could result in parser error.

    CVE 2014-6603

    Signed-off-by: Eric Leblond <eric@regit.org>

Reported by Steffen Bauch

Actions

Copy link

Updated by Victor Julien over 9 years ago

Status changed from Assigned to Closed
% Done changed from 0 to 100

Actions

Copy link

Updated by Victor Julien over 9 years ago

A work around is to simply disable the ssh app layer module:

app-layer:
  protocols:
    tls:
      enabled: yes
      detection-ports:
        dp: 443

      #no-reassemble: yes
    dcerpc:
      enabled: yes
    ftp:
      enabled: yes
    ssh:
      enabled: no

Alternatively, it can be set to 'detection-only'.

Actions

Copy link