Suricata 4.1.8 released

Posted on | by inliniac

We’re pleased to announce the release of Suricata 4.1.8. This is a larger than usual point release, with a number of important fixes.

This is the first release after Suricata joined the Oss-Fuzz program, leading to discovery of a number of (potential) security issues. We expect that in the coming months we’ll fix more such issues, as the fuzzers increase their coverage and we continue to improve the seed corpus.

Get the release here: https://www.openinfosecfoundation.org/download/suricata-4.1.8.tar.gz

As announced last month, we’re keeping the 4.1 branch supported longer than originally planned. See: https://suricata-ids.org/2020/03/25/suricata-4-1-eol-update-support-extended/

Changes

  • Bug #3492: Backport 4 BUG_ON(strcasecmp(str, “any”) in DetectAddressParseString
  • Bug #3508: rule parsing: memory leaks
  • Bug #3527: 4.1.x Kerberos vulnerable to TCP splitting evasion
  • Bug #3533: Skip over ERF_TYPE_META records
  • Bug #3551: file logging: complete files sometimes marked ‘TRUNCATED’
  • Bug #3572: rust: smb compile warnings
  • Bug #3579: Faulty signature with two threshold keywords does not generate an error and never match
  • Bug #3581: random failures on sip and http-evader suricata-verify tests
  • Bug #3596: ftp: asan detects leaks of expectations
  • Bug #3599: rules: memory leaks in pktvar keyword
  • Bug #3601: rules: bad address block leads to stack exhaustion
  • Bug #3603: rules: crash on ‘internal’-only keywords
  • Bug #3605: rules: missing ‘consumption’ of transforms before pkt_data would lead to crash
  • Bug #3607: rules: minor memory leak involving pcre_get_substring
  • Bug #3608: ssl/tls: ASAN issue in SSLv3ParseHandshakeType
  • Bug #3611: defrag: asan issue
  • Bug #3633: file-store.stream-depth not working as expected when configured to a specfic value (4.1.x)
  • Bug #3645: Invalid memory read on malformed rule with Lua script
  • Bug #3647: rules: memory leaks on failed rules
  • Bug #3648: CIDR Parsing Issue
  • Bug #3650: FTP response buffering against TCP stream
  • Bug #3652: Recursion stack-overflow in parsing YAML configuration
  • Bug #3659: Multiple DetectEngineReload and bad insertion into linked list lead to buffer overflow
  • Bug #3666: FTP: Incorrect ftp_memuse calculation.
  • Bug #3668: Signature with an IP range creates one IPOnlyCIDRItem by signe IP address
  • Bug #3671: Protocol detection evasion by packet splitting
  • Bug #3676: Segfault on SMTP TLS
  • Feature #3482: GRE ERSPAN Type 1 Support
  • Task #3479: libhtp 0.5.33 (4.1.x)
  • Task #3513: SMTP should place restraints on variable length items (e.g., filenames)
  • Bundled libhtp 0.5.33
  • Bundled Suricata-Update 1.0.7

Special thanks

Oss-Fuzz, Coverity Scan, Giuseppe Longo, Stephen Donnelly

Free Webinar

Join our Free webinar on Hunting Threats in Encrypted traffic: https://suricata-ids.org/2020/04/14/webinar-hunting-threats-that-use-encrypted-network-traffic-with-suricata/

Forums

Join our new Forum at https://forum.suricata.io/

About Suricata

Suricata is a high performance Network Threat Detection, IDS, IPS and Network Security Monitoring engine. Open source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by OISF, its supporting vendors and the community.