Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow.
This issue is fixed in version 8.0.6.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 6
https://github.com/OISF/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18
security-advisories@github.com
https://github.com/OISF/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc
security-advisories@github.com
https://github.com/OISF/suricata/pull/15704
security-advisories@github.com
https://github.com/OISF/suricata/releases/tag/suricata-8.0.6
security-advisories@github.com
https://github.com/OISF/suricata/security/advisories/GHSA-56wx-7hqh-wfgr
security-advisories@github.com
https://redmine.openinfosecfoundation.org/issues/8659
security-advisories@github.com