CVE-2019-18792

published 2020-01-06

CVE-2019-18792: An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake…

Priority P3 49 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C N I H A H

An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injected just before the PUSH ACK packet we want to bypass. The PUSH ACK packet (containing the data) will be ignored by Suricata because it overlaps the FIN packet (the sequence and ack number are identical in the two packets). The client will ignore the fake FIN packet because the ACK flag is not set. Both linux and windows clients are ignoring the injected packet.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	suricata	< suricata 1:5.0.2-1 (bookworm)	suricata 1:5.0.2-1 (bookworm)
oisf	suricata	—	—
oisf	suricata	>= 0 < 1:5.0.2-1	1:5.0.2-1
oisf	suricata	>= 0 < 1:5.0.2-1	1:5.0.2-1
oisf	suricata	>= 0 < 1:5.0.2-1	1:5.0.2-1
oisf	suricata	>= 0 < 1:5.0.2-1	1:5.0.2-1
oisf	suricata	>= 4.1.5 < 4.1.6	4.1.6

CVSS provenance

nvd v3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

nvd v2.0 6.4 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:P

osv 9.1 CRITICAL

vendor_debian 9.1 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-436 CWE-94