Input validation error in Suricata - CVE-2024-55629
Published: January 10, 2025
Vulnerability identifier: #VU102514
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-55629
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect handling of TCP streams with TCP urgent data (out of band data), which can lead to Suricata analyzing data differently than the applications at the TCP endpoints. A remote attacker can bypass generic detection when using TCP urgent support.
Affected software
Suricata
Kaspersky IoT Secure Gateway Network Protector
Kaspersky Anti Targeted Attack
Fedora
suricata
Kaspersky IoT Secure Gateway Network Protector
Kaspersky Anti Targeted Attack
Fedora
suricata
How to mitigate CVE-2024-55629
Install updates from vendor's website.
Suricata - update to 7.0.8
Kaspersky Anti Targeted Attack - addressed in versions 6.0.4, 7.0.3
Kaspersky IoT Secure Gateway Network Protector - update to 3.1.0.130
suricata - addressed in versions 7.0.8-1.el8, 7.0.8-1.el9, 7.0.8-1.fc40, 7.0.8-1.fc41
Kaspersky Anti Targeted Attack - addressed in versions 6.0.4, 7.0.3
Kaspersky IoT Secure Gateway Network Protector - update to 3.1.0.130
suricata - addressed in versions 7.0.8-1.el8, 7.0.8-1.el9, 7.0.8-1.fc40, 7.0.8-1.fc41
External References
Related Security Bulletins
- Multiple vulnerabilities in Suricata
- Fedora 41 update for suricata
- Fedora EPEL 9 update for suricata
- Fedora 40 update for suricata
- Fedora EPEL 8 update for suricata
- Multiple vulnerabilities in Kaspersky Anti Targeted Attack Server
- Multiple vulnerabilities in Kaspersky IoT Secure Gateway Network Protector