Open Information Security Foundation

03/30/2023

04:05 PM Suricata Bug #5363: Memory leak in rust SMB file tracker

I'd be curious to hear the results of Maayan's tests as well, but on our network we are still seeing significant suri... Orion Poplawski

12/26/2022

09:06 PM Suricata Bug #5183: TLS Handshake Fragments not Reassembled

Is there any chance that this fix will get back ported to 6.0? Orion Poplawski

09/27/2022

08:31 PM Suricata Bug #5320: Key collisions in HTTP JSON eve-logs

I'll also note that the content_range field (and maybe others) are not documented here: https://suricata.readthedocs.... Orion Poplawski

08:25 PM Suricata Bug #5320: Key collisions in HTTP JSON eve-logs

This is causing problems ingesting the Suricata EVE data into ElasticSearch/OpenSearch due to the differing format (o... Orion Poplawski

08/09/2022

02:59 PM Suricata Bug #5492 (New): Applayer Detect protocol only one direction - Kerberos

Some kerberos traffic between a Synology NAS and a Windows Active directory controller generates the following alert:... Orion Poplawski

02:55 PM Suricata Bug #5491 (New): SMTP response 221 appears to generate an SMTP invalid response alert

We have a public facing mail server and we see a lot of SMTP invalid reply alerts when it issues a response like:
... Orion Poplawski

08/08/2022

09:02 PM Suricata Bug #5490 (New): Applayer Detect protocol only one direction - NFS

Some NFS traffic generates the following alert:
[**] [1:324000010:1] SURICATA Applayer Detect protocol only one d... Orion Poplawski

10/06/2021

04:45 PM Suricata Bug #4740: libnet error with reject action on pfSense

libnet version is 1.1.6_5,1
Orion Poplawski

04:29 PM Suricata Bug #4740 (New): libnet error with reject action on pfSense

Running 6.0.3 on pfSense-plus 21.05.1. When I set a rule action to reject I get the following error in the suricata.... Orion Poplawski

02/11/2019

10:12 PM Suricata Bug #2809 (Closed): Applayer Mismatch protocol both directions for kerberos AS-REQ/KDC_ERR_PREAUTH_REQUIRED exchange

We're seeing lots of "SURICATA Applayer Mismatch protocol both directions" alerts for kerberos traffic.... Orion Poplawski