projects / suricata.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e43f888) | patch
[PATCH] stream/tcp: don't reject on bad ack
authorEric Leblond <el@stamus-networks.com>
Fri, 28 May 2021 10:19:38 +0000 (12:19 +0200)
committerThorsten Alteholz <debian@alteholz.de>
Sun, 30 Mar 2025 10:03:02 +0000 (12:03 +0200)
commit32990475bb997aea712d75526cf4b9381e254f1d
tree824abb0cb65e363ea58df8c35a5eb4ff6da4c068tree | snapshot
parente43f8882ffb4c36401dc79b8ce153536bbe36a20commit | diff
[PATCH] stream/tcp: don't reject on bad ack

Not using a packet for the streaming analysis when a non zero
ACK value and ACK bit was unset was leading to evasion as it was
possible to start a session with a SYN packet with a non zero ACK
value to see the full TCP stream to escape all stream and application
layer detection.

This addresses CVE-2021-35063.

Fixes: fa692df37 ("stream: reject broken ACK packets")
Ticket: #4504.

Gbp-Pq: Name stream-no-reject-bad-ack.patch
src/stream-tcp.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.