Actions
Security #7195
closeddatasets: rule with unset makes suricata abort
Git IDs:
e47598110a557bb9f87ea498d85ba91a45bb0cb6
Severity:
HIGH
Disclosure Date:
Description
Running SV datasets-03-set test with added rule
diff --git a/tests/datasets-03-set/test.rules b/tests/datasets-03-set/test.rules
index 1d99df9d..327c774a 100644
--- a/tests/datasets-03-set/test.rules
+++ b/tests/datasets-03-set/test.rules
@@ -1 +1,2 @@
alert dns any any -> any any (dns.query; dataset:set,dns-seen, type string; sid:1;)
+alert dns any any -> any any (dns.query; content: "example"; dataset:unset,dns-seen, type string; sid:2;)
triggers the abort in DetectDatasetBufferMatch because we get DETECT_DATASET_CMD_UNSET
Actions