Buffer Overflow Vulnerability in Suricata Prior to 7.0.5 and 6.0.19

CVE-2024-32664

What is CVE-2024-32664?

The vulnerability present in Suricata, a prominent open-source network Intrusion Detection System (IDS), allows an attacker to exploit a limited buffer overflow through specially crafted traffic or datasets. This issue impacts versions prior to 7.0.5 and 6.0.19, requiring users to update to the patched versions to mitigate risks. As a temporary workaround, users are advised to avoid using rules containing the base64_decode keyword with the bytes option set to values like 1, 2, or 5. For those using version 7.0.x, disabling the app-layer.protocols.smtp.mime.body-md5 setting is recommended to reduce vulnerability exposure. Prompt updates and vulnerability management practices are essential for maintaining robust network security.

News Articles

@Securelist

CVE-2024-32664CVE-2024-32041

Kaspersky found multiple memory corruptions in Suricata and FreeRDP

While pentesting KasperskyOS-based Thin Client and IoT Secure Gateway, we found several vulnerabilities in the Suricata and FreeRDP open-source projects. We shared details on these vulnerabilities with the community along with our fuzzer.

References