CVE-2019-18625
- State
- Published
- Severity
- Not scored
- Published
- Jan 6, 2020
- Updated
- Aug 5, 2024
- Reserved
- Oct 29, 2019
Description
An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the RST ACK and the FIN ACK packets because of the bad TCP Timestamp option. Both linux and windows client are ignoring the injected packets.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://redmine.openinfosecfoundation.org/issues/3286
- https://github.com/OISF/suricata/commit/9f0294fadca3dcc18c919424242a41e01f3e8318
- https://redmine.openinfosecfoundation.org/issues/3395
- https://github.com/OISF/suricata/commit/ea0659de7640cf6a51de5bbd1dbbb0414e4623a0
- [debian-lts-announce] 20200130 [SECURITY] [DLA 2087-1] suricata security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.