Project

General

Profile

Feature #2767

Interception of network stack attacks

Added by Nikolay Lyamin 11 days ago. Updated 11 days ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:

Description

Hello, Team!
Please add the ability to detect bytes in traffic that is not included under the transport or network layer.
For example, a broken UDP packet in which there is a payload for RCE vulnerability. In this packet the size of UDP and IP (fields «Total Length» of IP and «Length» of UDP) was cuted in the hex editor. Only 1 byte for the size of the data is specified in the UDP header (in the image from attach it's Data 06). But the "evil" payload in the packet remained outside UDP |00 00 05 00 01 00 00|. It is not possible to detect this data by suricata.
Best regards, Nikolay Lyamin

attach.png (79.4 KB) attach.png Nikolay Lyamin, 01/09/2019 09:46 AM
udp_corrupt.pcap (90 Bytes) udp_corrupt.pcap Nikolay Lyamin, 01/09/2019 11:59 AM

History

#1 Updated by Peter Manev 11 days ago

Is it possible to share the actual pcap?

#2 Updated by Nikolay Lyamin 11 days ago

yes, sure

Also available in: Atom PDF