[Secure-testing-team] Bug#889842: suricata: CVE-2018-6794: do not parse HTTP responses if tcp data was sent before 3-way-handshake completed

[Salvatore Bonaccorso]

Source: suricata
Version: 1:4.0.3-1
Severity: important
Tags: patch security upstream
Forwarded: https://redmine.openinfosecfoundation.org/issues/2427

Hi,

the following vulnerability was published for suricata.

CVE-2018-6794[0]:
| Suricata before 4.1 is prone to an HTTP detection bypass vulnerability
| in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP
| flow and sends data before the 3-way handshake is complete, then the
| data sent by the malicious server will be accepted by web clients such
| as a web browser or Linux CLI utilities, but ignored by Suricata IDS
| signatures. This mostly affects IDS signatures for the HTTP protocol
| and TCP stream content; signatures for TCP packets will inspect such
| network traffic as usual.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-6794
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6794
[1] https://redmine.openinfosecfoundation.org/issues/2427
[2] https://github.com/OISF/suricata/pull/3202/commits/e1ef57c848bbe4e567d5d4b66d346a742e3f77a1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore