Kirill Shipulin

3 exploits Active since Feb 2018
CVE-2016-10728 WRITEUP MEDIUM WORKING POC
Suricata < 3.1.2 - Rule Grouping Bypass via ICMPv4 Error Packet
An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection.
CVSS 5.3
CVE-2018-14568 WRITEUP HIGH WORKING POC
Suricata < 4.0.5 - Detection Bypass via TCP RST Handling
Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. This allows detection bypass because Windows TCP clients proceed with normal processing of TCP data that arrives shortly after an RST (i.e., they act as if the RST had not yet been received).
CVSS 7.5
CVE-2018-6794 EXPLOITDB MEDIUM text WRITEUP
Suricata < 4.0.4 - HTTP Detection Bypass via TCP Handshake Evasion
Suricata before 4.0.4 is prone to an HTTP detection bypass vulnerability in detect.c and stream-tcp.c. If a malicious server breaks a normal TCP flow and sends data before the 3-way handshake is complete, then the data sent by the malicious server will be accepted by web clients such as a web browser or Linux CLI utilities, but ignored by Suricata IDS signatures. This mostly affects IDS signatures for the HTTP protocol and TCP stream content; signatures for TCP packets will inspect such network traffic as usual.
CVSS 5.3