Security #4512: Evasion possibility on wrong/unexpected ACK value in crafted SYN packets - Suricata - Open Information Security Foundation

Actions

Copy link

Security #4512

closed

Evasion possibility on wrong/unexpected ACK value in crafted SYN packets

Added by Jeff Lucovsky almost 3 years ago. Updated over 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Victor Julien

Target version:

6.0.3

Affected Versions:

Label:

CVE:

2021-35063

Git IDs:

54ebee6f516f983a21d952ec6cf4292ed8ba9d8d

Severity:

CRITICAL

Disclosure Date:

Description

affected versions: all

Please see the pcap attached.
Basically it logs no HTTP even with midstream enabled.

The problem is the first packet right away as it has ACK value that we check and disregard the whole flow/session.But Windows and Linux accept those and everyone else it seems.

Please also see attached a test case(py file) and a patch by Eric.

The pcap can not be shared or made public except of the devs with access to this issue of course.

Files

Download all files

test-nozero-ack.py (403 Bytes) test-nozero-ack.py		Peter Manev, 05/28/2021 10:02 AM
0001-stream-tcp-avoid-evasion-by-sending-crafted-SYN-pack.patch (1.78 KB) 0001-stream-tcp-avoid-evasion-by-sending-crafted-SYN-pack.patch		Peter Manev, 05/28/2021 10:02 AM