OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99 and sources.py:131. The "list-sources"-command is affected by this bug. that can result in Remote Code Execution(even as root if suricata-update is called by root). This attack appears to be exploitable via a specially crafted yaml-file at https://www.openinfosecfoundation.org/rules/index.yaml. This vulnerability appears to have been fixed in 1.0.0b1.
References
Link | Resource |
---|---|
https://redmine.openinfosecfoundation.org/issues/2359 | Third Party Advisory |
https://tech.feedyourhead.at/content/remote-code-execution-in-suricata-update | Exploit Third Party Advisory |
https://redmine.openinfosecfoundation.org/issues/2359 | Third Party Advisory |
https://tech.feedyourhead.at/content/remote-code-execution-in-suricata-update | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 03:39
Type | Values Removed | Values Added |
---|---|---|
References | () https://redmine.openinfosecfoundation.org/issues/2359 - Third Party Advisory | |
References | () https://tech.feedyourhead.at/content/remote-code-execution-in-suricata-update - Exploit, Third Party Advisory |
Information
Published : 2018-04-18 19:29
Updated : 2024-11-21 03:39
NVD link : CVE-2018-1000167
Mitre link : CVE-2018-1000167
CVE.ORG link : CVE-2018-1000167
JSON object : View
Products Affected
oisf
- suricata-update
CWE
CWE-502
Deserialization of Untrusted Data