TCP Packet Manipulation in Suricata Firewall by Open Information Security Foundation

CVE-2021-45098

What is CVE-2021-45098?

A vulnerability has been discovered in Suricata, a high-performance network IDS, IPS, and NSM engine, which affects versions prior to 6.0.4. This issue allows attackers to bypass HTTP-based signatures by exploiting the TCP protocol through manipulation of RST packets. Specifically, an attacker can forge an RST TCP packet with random TCP options from the client side following the three-way handshake, and subsequently send an HTTP GET request to a forbidden URL. As a result, the vulnerable server does not recognize the injected RST ACK, leading to the unauthorized processing of requests that would otherwise be blocked, compromising the integrity of the security measures in place.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References