Ubuntu.comUB:CVE-2019-18625CVE-2019-18625
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
58.6%
An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade
any tcp based signature by faking a closed TCP session using an evil
server. After the TCP SYN packet, it is possible to inject a RST ACK and a
FIN ACK packet with a bad TCP Timestamp option. The client will ignore the
RST ACK and the FIN ACK packets because of the bad TCP Timestamp option.
Both linux and windows client are ignoring the injected packets.
References
github.com/OISF/suricata/commit/9f0294fadca3dcc18c919424242a41e01f3e8318
github.com/OISF/suricata/commit/9f0294fadca3dcc18c919424242a41e01f3e8318 (suricata-5.0.1)
github.com/OISF/suricata/commit/ea0659de7640cf6a51de5bbd1dbbb0414e4623a0
github.com/OISF/suricata/commit/ea0659de7640cf6a51de5bbd1dbbb0414e4623a0 (master-4.1.x)
launchpad.net/bugs/cve/CVE-2019-18625
nvd.nist.gov/vuln/detail/CVE-2019-18625
redmine.openinfosecfoundation.org/issues/3286
redmine.openinfosecfoundation.org/issues/3395
security-tracker.debian.org/tracker/CVE-2019-18625
www.cve.org/CVERecord?id=CVE-2019-18625
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
58.6%