Bug 14240 - suricata new security issue CVE-2014-6603
Summary: suricata new security issue CVE-2014-6603
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Daniel Lucio
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/615073/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-06 19:28 CEST by David Walser
Modified: 2014-10-06 22:50 CEST (History)
2 users (show)

See Also:
Source RPM: suricata-2.0.2-3.mga5.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2014-10-06 19:28:14 CEST 
Fedora has issued an advisory on September 25:
https://lists.fedoraproject.org/pipermail/package-announce/2014-October/139821.html

The issue is fixed upstream in 2.0.4.

The initial report says that versions older than 2.0.3 *may* be affected, but I haven't seen a clarification as to whether they are:
http://seclists.org/fulldisclosure/2014/Sep/79

Reproducible: 

Steps to Reproduce:
David Walser 2014-10-06 19:28:36 CEST

CC: (none) => guillomovitch, pterjan
Whiteboard: (none) => MGA4TOO, MGA3TOO

Comment 1 David Walser 2014-10-06 21:40:22 CEST 
Guillaume fixed this in Cauldron with suricata-2.0.4-1.mga5.  Thanks Guillaume!

We might need more investigation to see if 1.4.x in Mageia 3 and 4 are affected, or we could just update it if it's OK to do so.

Version: Cauldron => 4
Whiteboard: MGA4TOO, MGA3TOO => MGA3TOO

Comment 2 Pascal Terjan 2014-10-06 22:29:12 CEST 
Reading the code in 1.4 and 1.4.7 they don't seem affected as they don't use "\r" to find the end of the string, they just discard it if the version ends up finishing with it.
I'll try to get some upstream confirmation.
Comment 3 Pascal Terjan 2014-10-06 22:45:12 CEST 
Got confirmation that 1.4 is fine https://twitter.com/Regiteric/status/519226322166763520
Comment 4 David Walser 2014-10-06 22:50:32 CEST 
Thanks Pascal!

Status: NEW => RESOLVED
Version: 4 => Cauldron
Resolution: (none) => FIXED
Whiteboard: MGA3TOO => (none)
Note You need to log in before you can comment on or make changes to this bug.