Login Sign Up

CVE-2019-18625

7.5 HIGH

📋 TL;DR

This vulnerability allows an attacker to bypass TCP-based intrusion detection signatures in Suricata by sending specially crafted TCP packets with invalid timestamp options. It affects Suricata users running version 5.0.0 who rely on TCP-based signature detection.

💻 Affected Systems

Products:
  • Suricata
Versions: 5.0.0
Operating Systems: Linux, Windows, All platforms running Suricata
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects TCP-based signature detection. Requires Suricata to be configured to inspect TCP traffic.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Suricata by Oisf

View all CVEs affecting Suricata →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers can evade detection of malicious TCP traffic, allowing malware delivery, data exfiltration, or other attacks to go unnoticed by the IDS/IPS.

🟠

Likely Case

Targeted evasion of specific TCP-based signatures, potentially allowing certain attacks to bypass network security monitoring.

🟢

If Mitigated

With proper patching, the evasion technique is prevented and TCP signatures function as intended.

🌐 Internet-Facing: MEDIUM
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: MEDIUM

Exploitation requires network access to send crafted TCP packets to the Suricata sensor. The technique involves specific TCP timestamp manipulation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 5.0.1 and later

Vendor Advisory: https://redmine.openinfosecfoundation.org/issues/3286

Restart Required: Yes

Instructions:

1. Update Suricata to version 5.0.1 or later. 2. Restart the Suricata service. 3. Verify the update was successful.

🔧 Temporary Workarounds

Disable TCP timestamp checking

all

Configure Suricata to ignore TCP timestamp options, though this may affect some legitimate traffic analysis.

# Add to suricata.yaml: detect.tcp.timestamp: false

🧯 If You Can't Patch

  • Implement network segmentation to limit exposure to potential attackers.
  • Use additional security controls like application-layer firewalls or host-based IDS to complement Suricata.

🔍 How to Verify

Check if Vulnerable:

Check Suricata version: if running 5.0.0, the system is vulnerable.

Check Version:

suricata --build-info | grep Version

Verify Fix Applied:

Verify Suricata version is 5.0.1 or later and check that TCP-based signatures are being triggered appropriately.

📡 Detection & Monitoring

Log Indicators:

  • Unusual TCP session resets with malformed timestamp options
  • Missing expected TCP signature alerts for known malicious traffic

Network Indicators:

  • TCP packets with invalid timestamp options followed by session reset attempts
  • Suspicious TCP handshake patterns

SIEM Query:

source="suricata" AND (event_type="alert" AND NOT signature_id=*) OR (tcp.flags="RST" AND tcp.options.timestamp invalid)

📊 Metadata

CVE ID: CVE-2019-18625
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published: January 6, 2020
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON