Actions
Bug #7414
closeddetect: decoder event rules fail to match on invalid packets
Affected Versions:
Effort:
Difficulty:
Label:
Description
An ipv4 packet that contains malformed security option with invalid length field (2 bytes) and invalid bytes length (12 bytes) with respect the length field is not detected.
My setup is AlmaLinux 8.10, Suricata 7.0.7 in IPS Layer 2 mode and has the following rule that is never triggered:
drop pkthdr any any -> any any (msg:"SURICATA IPv4 invalid option length"; decode-event:ipv4.opt_invalid_len; classtype:protocol-command-decode; sid:2200005; rev:2;)In attach pcap file where the third packet contains the invalid ipv4 security option.
Files
Actions