Asymmetric Resource Consumption (Amplification) in Suricata - CVE-2024-55628

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU102515

Asymmetric Resource Consumption (Amplification) in Suricata - CVE-2024-55628

Published: January 10, 2025


Vulnerability identifier: #VU102515
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-55628
CWE-ID: CWE-405
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allow a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect handling of DNS resource name compression. A remote attacker can send small DNS messages containing very large hostnames and force the software to render very large DNS log records, leading to denial of service conditions.


Affected software

Suricata
Kaspersky IoT Secure Gateway Network Protector
Kaspersky Anti Targeted Attack
Fedora
suricata

How to mitigate CVE-2024-55628

Install updates from vendor's website.

Suricata - update to 7.0.8
Kaspersky Anti Targeted Attack - addressed in versions 6.0.4, 7.0.3
Kaspersky IoT Secure Gateway Network Protector - update to 3.1.0.130
suricata - addressed in versions 7.0.8-1.el8, 7.0.8-1.el9, 7.0.8-1.fc40, 7.0.8-1.fc41

External References

Related Security Bulletins