Project

General

Profile

Actions
Copy link

Security #4513

closed
JL JL

Evasion possibility on wrong/unexpected ACK value in crafted SYN packets

Security #4513: Evasion possibility on wrong/unexpected ACK value in crafted SYN packets

Added by Jeff Lucovsky almost 5 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jeff Lucovsky
Target version:
5.0.7
Affected Versions:
5.0.6
Label:
CVE:
2021-35063
Git IDs:

f61ef79781605a5d1d75d8bf023da9552f781301

Severity:
CRITICAL
Disclosure Date:

Description

affected versions: all

Please see the pcap attached.
Basically it logs no HTTP even with midstream enabled.

The problem is the first packet right away as it has ACK value that we check and disregard the whole flow/session.But Windows and Linux accept those and everyone else it seems.

Please also see attached a test case(py file) and a patch by Eric.

The pcap can not be shared or made public except of the devs with access to this issue of course.

Files

Download all files
test-nozero-ack.py (403 Bytes) test-nozero-ack.py Peter Manev, 05/28/2021 10:02 AM
0001-stream-tcp-avoid-evasion-by-sending-crafted-SYN-pack.patch (1.78 KB) 0001-stream-tcp-avoid-evasion-by-sending-crafted-SYN-pack.patch Peter Manev, 05/28/2021 10:02 AM

Related issues 1 (0 open — 1 closed)

Copied from Suricata - Security #4504: tcp: Evasion possibility on wrong/unexpected ACK value in crafted SYN packetsClosedEric LeblondActions

JL Updated by Jeff Lucovsky almost 5 years ago Actions
Copy link
 #1

  • Copied from Security #4504: tcp: Evasion possibility on wrong/unexpected ACK value in crafted SYN packets added

JL Updated by Jeff Lucovsky almost 5 years ago Actions
Copy link
 #2

  • Status changed from Assigned to In Progress

Cherry-picks:
- 91f830afd1fb3276448eb60ce8832fc383612820
- a21fe46244d63f87e7e8ef4369189096e3e0d946
- 2c99939b710c36bb0c3d02e0614d4ab9a84d00ab

JL Updated by Jeff Lucovsky almost 5 years ago Actions
Copy link
 #3

  • Status changed from In Progress to In Review

VJ Updated by Victor Julien almost 5 years ago Actions
Copy link
 #4

  • Status changed from In Review to Closed
  • Affected Versions 5.0.6 added

VJ Updated by Victor Julien almost 5 years ago Actions
Copy link
 #5

  • Priority changed from High to Normal
  • CVE set to 2021-35063
  • Git IDs updated (diff)
  • Severity set to CRITICAL

VJ Updated by Victor Julien over 4 years ago Actions
Copy link
 #6

  • Private changed from Yes to No
Actions
Copy link

Also available in: PDF Atom