Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-10050: Suricata 4.1.x before 4.1.4: Malicious packet causes program to crash

CVE-2019-10050 · published 7 years ago

Summary

A security issue in Suricata can cause the program to crash if it receives a specially crafted network packet. This could be exploited by an attacker to disrupt Suricata's operation. To fix this issue, update to Suricata version 4.1.4 or later.

What to do

Update debian suricata to version 1:4.1.4-1.
Update oisf suricata to version 4.1.4 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:11	debian	suricata	< 1:4.1.4-1 Fix: upgrade to 1:4.1.4-1
Debian:13	debian	suricata	< 1:4.1.4-1 Fix: upgrade to 1:4.1.4-1
Debian:14	debian	suricata	< 1:4.1.4-1 Fix: upgrade to 1:4.1.4-1
–	oisf	suricata	>= 4.0.0, < 4.1.4 `cpe:2.3:a:oisf:suricata::::::::`

Original advisory text

A buffer over-read issue was discovered in Suricata 4.1.x before 4.1.4. If the input of the decode-mpls.c function DecodeMPLS is composed only of a packet of source address and destination address plus the correct type field and the right number for shim, an attacker can manipulate the control flow, such that the condition to leave the loop is true. After leaving the loop, the network packet has a length of 2 bytes. There is no validation of this length. Later on, the code tries to read at an empty position, leading to a crash.

References

https://security-tracker.debian.org/tracker/CVE-2019-10050 Vendor Advisory
https://lists.openinfosecfoundation.org/pipermail/oisf-announce/ Third Party Advisory
https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/ Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published13 May 2019

Updated4 Nov 2026

First seen16 May 2026

Sources

DEBIAN-CVE-2019-10050 · OSV

CVE-2019-10050 · NVD

Track software like this

Free during beta