Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OISF suricata
>= 8.0.0, < 8.0.6affected< 7.0.17affected
References
- https://github.com/OISF/suricata/security/advisories/GHSA-jh8w-wf3f-58jp ↗
- https://github.com/OISF/suricata/pull/15676 ↗
- https://github.com/OISF/suricata/commit/0dad38fff024b4fec9bc8144d8b94dbca39aac2e ↗
- https://github.com/OISF/suricata/commit/2b924d47cc51d0b7760cda3519f2c04a2f65ea38 ↗
- https://github.com/OISF/suricata/commit/ac1b3cc1ef3af65ce92da28261d445167eb8234d ↗
- https://github.com/OISF/suricata/releases/tag/suricata-7.0.17 ↗
- https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 ↗
- https://redmine.openinfosecfoundation.org/issues/8600 ↗