Open Information Security Foundation

03/22/2022

02:31 AM Suricata Bug #5201 (Closed): content:"22 2 22"; is parsed without error

This should probably cause suricata to freak out. It was a rule bug in 2035512 and according to @bmurphy even snort t... Gianni Tedesco

03/08/2022

12:56 AM Suricata Bug #5183 (Closed): TLS Handshake Fragments not Reassembled

TLS handshakes can be sent in multiple TLS frames. This is because the handshakes can be larger than the max size of ... Gianni Tedesco

02/03/2022

01:13 AM Suricata Documentation #5030: Documentation bugs for endswith, distance, within

"The relationship established between /resp_ and .txt by using the distance keyword is critical to this rules inspect... Gianni Tedesco

12:52 AM Suricata Documentation #5030: Documentation bugs for endswith, distance, within

Here are the locations and sids for all such rules, hope it helps!
rules/emerging-malware.rules:12697 2027222
rul... Gianni Tedesco

02/01/2022

02:22 AM Suricata Documentation #5030 (New): Documentation bugs for endswith, distance, within

Documentation says: "endswith cannot be mixed with offset, within or distance for the same pattern."
Looks untrue,... Gianni Tedesco

09/01/2021

11:47 PM Suricata Bug #4657 (New): SSLv2 app-layer detection patterns incorrectly registered

The SSLv2 record format starts with 2 byte length, then it has a 1 byte
message-type field set to |01| for the clien... Gianni Tedesco