Suricata Stack Overflow Vulnerability in SWF Decompression Allowing Denial-of-Service

A stack overflow vulnerability has been identified in Suricata, a network IDS, IPS, and NSM engine, prior to versions 7.0.13 and 8.0.2. This vulnerability can cause Suricata to crash when SWF decompression is enabled. The issue arises from improper handling of larger compressed data, leading to a stack overflow.

Impact

Exploitation of this vulnerability causes Suricata to crash, creating a denial-of-service condition.

Remediation

Users can update to Suricata versions 7.0.13 or 8.0.2 to address this vulnerability. Alternatively, SWF decompression can be disabled in the suricata.yaml configuration file, where it is turned off by default. If SWF decompression must be enabled, the 'decompress-depth' setting should be adjusted to less than half the stack size.