Open Information Security Foundation

08/12/2019

03:22 PM Suricata Security #2969: http_header signature do not alert on HTTP response with a single \r\n ending

Hi guys, any update on it ? ajaxtpm ajaxtpm

05/07/2019

11:27 AM Suricata Security #2969 (Closed): http_header signature do not alert on HTTP response with a single \r\n ending

Signature:
alert http any any -> any any (msg: "'ng1nx' Server header found"; flow: established, from_server; conten... ajaxtpm ajaxtpm

07/09/2018

02:41 PM Suricata Bug #2510: Suricata doesnt decompress HTTP Post body

Victor Julien wrote:
> Libhtp, which does the decompression on the response body side, simply doesn't implement deco... ajaxtpm ajaxtpm

06/04/2018

05:03 PM Suricata Bug #2511 (Closed): Suricata gzip unpacker bypass

Suricata gzip unpacker may be easily bypassed by nested gzip/identity compressions.
I know there is option "response... ajaxtpm ajaxtpm

04:56 PM Suricata Bug #2510 (Closed): Suricata doesnt decompress HTTP Post body

The subject is self-explained. If I send a HTTP Post request with gzipped Post body it doesnt get decompressed and cl... ajaxtpm ajaxtpm

04:50 PM Suricata Security #2501: Suricata stops inspecting TCP stream if a TCP RST was met

Hi guys, do you have any updates on it ? ajaxtpm ajaxtpm

05/14/2018

09:16 AM Suricata Security #2501: Suricata stops inspecting TCP stream if a TCP RST was met

Peter Manev wrote:
> Out of curiosity - from your tests/observations - is that with any windows client OS or specifi... ajaxtpm ajaxtpm

05/10/2018

08:59 AM Suricata Security #2501: Suricata stops inspecting TCP stream if a TCP RST was met

Hi Andreas,
Any news on that? ajaxtpm ajaxtpm

05/03/2018

02:22 PM Suricata Security #2501 (Closed): Suricata stops inspecting TCP stream if a TCP RST was met

Windows clients are able to process TCP data even if they arrived shortly after TCP RST packet so the current behavio... ajaxtpm ajaxtpm

02/07/2018

02:34 AM Suricata Security #2427: Suricata 3.x.x and 4.x.x do not parse HTTP responses if tcp data was sent before 3-way-handshake completed

CVE-2018-6794 ajaxtpm ajaxtpm