CVE-2017-15377

In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engine doesn't stop when it should after no match is found; instead, it stops only upon reaching inspection-recursion-limit (3000 by default).

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/OISF/suricata/commit/b9579fbe7dd408200ef03cbe20efddb624b73885
https://lists.debian.org/debian-lts-announce/2018/12/msg00000.html
https://redmine.openinfosecfoundation.org/issues/2231	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openinfosecfoundation:suricata:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-10-23 08:29

Updated : 2023-12-10 12:15

NVD link : CVE-2017-15377

Mitre link : CVE-2017-15377

CVE.ORG link : CVE-2017-15377

JSON object : View

Products Affected

openinfosecfoundation

suricata

CWE

NVD-CWE-noinfo

{"id": "CVE-2017-15377", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-10-23T08:29:00.430", "references": [{"url": "https://github.com/OISF/suricata/commit/b9579fbe7dd408200ef03cbe20efddb624b73885", "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2018/12/msg00000.html", "source": "cve@mitre.org"}, {"url": "https://redmine.openinfosecfoundation.org/issues/2231", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engine doesn't stop when it should after no match is found; instead, it stops only upon reaching inspection-recursion-limit (3000 by default)."}, {"lang": "es", "value": "En Suricata en versiones anteriores a las 4.x, era posible desencadenar numerosos chequeos redundantes en el contenido del trafico de red manipulado con una firma especifica a causa de DetectEngineContentInspection en detect-engine-content-inspection.c. El motor de busqueda no se detiene cuando deber\u00ed\u00ada despues de que no se encuentre ninguna coincidencia. En su lugar, solo se detiene al llegar al l\u00ed\u00admite de recursi\u00f3n de inspecci\u00f3nn (3000 por defecto)."}], "lastModified": "2020-10-27T14:15:13.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openinfosecfoundation:suricata:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA496538-972D-4CF8-822E-F1F4BE498669", "versionEndIncluding": "3.2.4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}