Actions
Security #7657
closed
AM
VJ
tcp: syn resend with different seq leads to detection bypasss
Security #7657:
tcp: syn resend with different seq leads to detection bypasss
Git IDs:
Severity:
HIGH
Disclosure Date:
Description
When performing SYN flooding, followed by an HTTP transaction, suricata is not able to detect the application layer protocol, leading to a false negative.
Tested in latest master with default configuration.
Attaching signature (test.rule) and 2 pcaps: syn_flood.pcapng and exploit.pcapng.
The first one contains the SYN flooding + HTTP transaction that should trigger the signature (but it does not trigger).
The second one contains only the HTTP transaction and correctly triggers the signature.
Files
Actions