Security #6866: eve: excessive ssh long banner logging - Suricata - Open Information Security Foundation

Actions

Copy link

Security #6866

closed

eve: excessive ssh long banner logging

Added by Victor Julien about 2 months ago. Updated about 1 month ago.

Status:

Closed

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

8.0.0-beta1

Affected Versions:

Label:

CVE:

2024-28870

Git IDs:

Severity:

HIGH

Disclosure Date:

02/19/2024

Description

Found by oss-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64345&q=label%3AProj-suricata&can=2

Fuzz target triggers the following rule
alert tcp any any -> any any (msg:"SURICATA STREAM ESTABLISHED packet out of window"; stream-event:est_packet_out_of_window; classtype:protocol-command-decode; sid:2210020; rev:2;)
on many packets leading to most time spent in jsonbuild set_string_from_bytes (doing escaping on binary buffer) for dummy overlong ssh software version

Files

sshlong.pcap (552 KB) sshlong.pcap

Philippe Antoine, 02/12/2024 12:05 PM

Subtasks 2 (0 open — 2 closed)