CVE-2016-10728 Other in n/a

Medium 5.3 Published 23 Jul 2018 Updated 6 Aug 2024

Suricata IDS/IPS may miss detections when processing specific ICMPv4 error packets, allowing attackers to bypass security rules.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-10728?

CVE-2016-10728 is a medium-severity vulnerability in n/a, published on 23 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection.

Weakness: CWE-20

Which versions are affected by CVE-2016-10728?

It affects 1 product.

Products include Suricata-Ids Suricata.

How do I fix CVE-2016-10728?

Upgrade to a fixed version.

Is CVE-2016-10728 being exploited?

There is no known exploitation of CVE-2016-10728 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2016-10728, DLA-1508-1, GHSA-hg98-gwg7-w72p, UBUNTU-CVE-2016-10728.