Suricata Stack Buffer Overflow Vulnerability in Version 8.0.0

A stack buffer overflow vulnerability has been identified in Suricata version 8.0.0. This issue arises in rules that use the keyword 'ldap.responses.attribute_type'—which is lengthy—combined with transforms. The buffer overflow can occur during the startup of Suricata or when reloading rules. This vulnerability has been addressed in Suricata version 8.0.1.

Impact

Exploitation of this vulnerability leads to a stack buffer overflow, which can commonly result in arbitrary code execution or causing a program to crash.

Reproduction

The vulnerability can be reproduced by creating a Suricata rule that includes the 'ldap.responses.attribute_type' keyword with transforms. When Suricata is started or the rules are reloaded, the buffer overflow will occur.

Remediation

Users can update to Suricata version 8.0.1, which patches this vulnerability. Instructions for downloading this version are available on the Open Information Security Foundation website.