High severity · published Jul 23, 2018
CVE-2018-14568
Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server
7.5
CVSS
2%
EPSS
No
On KEV
Description
Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. This allows detection bypass because Windows TCP clients proceed with normal processing of TCP data that arrives shortly after an RST (i.e., they act as if the RST had not yet been received).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
Suricata · Suricata-ids
before 4.0.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-14568
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-14568
Patch
https://github.com/OISF/suricata/pull/3428/commits/843d0b7a10bb45627f94764a6c5d468a24143345
Exploit
https://github.com/kirillwow/ids_bypass
Exploit
https://redmine.openinfosecfoundation.org/issues/2501
Vendor Advisory
https://suricata-ids.org/2018/07/18/suricata-4-0-5-available/
More from Suricata
9.8
CVE-2019-16411
An issue was discovered in Suricata 4.1.4
9.8
CVE-2019-10053
An issue was discovered in Suricata 4.1.x before 4.1.4
9.1
CVE-2019-16410
An issue was discovered in Suricata 4.1.4
9.1
CVE-2019-15699
An issue was discovered in app-layer-ssl.c in Suricata 4.1.4
7.5
CVE-2019-10056
An issue was discovered in Suricata 4.1.3