Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow. This issue is fixed in version 8.0.6.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OISF suricata
< 8.0.6affected
References
- https://github.com/OISF/suricata/security/advisories/GHSA-56wx-7hqh-wfgr ↗
- https://github.com/OISF/suricata/pull/15704 ↗
- https://github.com/OISF/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18 ↗
- https://github.com/OISF/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc ↗
- https://github.com/OISF/suricata/releases/tag/suricata-8.0.6 ↗
- https://redmine.openinfosecfoundation.org/issues/8659 ↗