Description
An issue was discovered in Suricata 5.0.0. It was possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server. After the TCP SYN packet, it is possible to inject a RST ACK and a FIN ACK packet with a bad TCP Timestamp option. The client will ignore the RST ACK and the FIN ACK packets because of the bad TCP Timestamp option. Both linux and windows client are ignoring the injected packets.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | suricata | 1:5.0.2-1 | — |
| Debian 13 | suricata | 1:5.0.2-1 | — |
| Debian 8 | suricata | 2.0.7-2+deb8u5 | DLA-2087-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | suricata | No fix yet | — |
| Ubuntu 16.04 LTS | suricata | No fix yet | — |
Advisories 1
- DLA-2087-1 suricata - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://redmine.openinfosecfoundation.org/issues/3286
- https://github.com/OISF/suricata/commit/9f0294fadca3dcc18c919424242a41e01f3e8318
- https://redmine.openinfosecfoundation.org/issues/3395
- https://github.com/OISF/suricata/commit/ea0659de7640cf6a51de5bbd1dbbb0414e4623a0
- [debian-lts-announce] 20200130 [SECURITY] [DLA 2087-1] suricata security update mailing-list