Tag Archive | ips

Suricata 4.1.3 released

We’re pleased to announce Suricata 4.1.3. This release fixes a number of issues found in the 4.1-series.

Get the release here: https://www.openinfosecfoundation.org/download/suricata-4.1.3.tar.gz

Changes

  • Bug #2225: when stats info dumping in redis,the decoder.ipv4.trunc_pkt can’t output.In the same time, in the stats.log this can output
  • Bug #2362: rule reload with workers mode and NFQUEUE not working stable
  • Bug #2761: Include ebpf files in distributed sources
  • Bug #2762: SSLv3 – AddressSanitizer heap-buffer-overflow
  • Bug #2770: TCP FIN/ACK, RST/ACK in HTTP – detection bypass
  • Bug #2788: afpacket doesn’t wait for all capture threads to start
  • Bug #2805: dns v1/2 with rust results in less app layer data available in the alert record (for dns related alerts/rules) (4.1.x)
  • Bug #2811: netmap/afpacket IPS: stream.inline: auto broken
  • Bug #2823: configure.ac: broken –{enable,disable}-xxx options (4.1.x)
  • Bug #2842: IPS mode crash under load
  • Bug #2855: Suricata does not bridge host <-> hw rings (Affects FreeBSD 11-STABLE, FreeBSD 12 and FreeBSD 13-CURRENT)
  • Bug #2862: pcre related FP in HTTP inspection (4.1.x)
  • Bug #2865: Suricata rule sid:2224005 SURICATA IKEv2 weak cryptographic parameters (Diffie-Hellman) not works (4.1.x)
  • Feature #2774: pcap multi dev support for Windows

Special thanks

Edwin van Vliet, Mats Klepsland, Pierre Chifflier, Alexander Gozman, Fabrice Fontaine, Jingyu Yang, Murat Balaban, Pascal Delalande

Trainings

2019 Training Calendar has been posted. There are still seats available for next weeks Advanced Deployment and Threat Hunting training in Washington, D.C. See https://suricata-ids.org/training/

Suricon

Suricon 2018 was a great success and the 2019 location has been announced: Amsterdam. Please consider becoming a sponsor! https://suricon.net/

About Suricata

Suricata is a high performance Network Threat Detection, IDS, IPS and Network Security Monitoring engine. Open source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by OISF, its supporting vendors and the community.

Suricata 4.0.7 available!

We’re pleased to announce Suricata 4.0.7.

Get the release here: https://www.openinfosecfoundation.org/download/suricata-4.0.7.tar.gz

EOL announcement

The Suricata 4.0.x branch will go end of life in 2 months, after which it will no longer be updated. If you are still on 4.0.x, it’s recommended that you start planning the upgrade to 4.1.x.

Changes

  • Bug #2714: Failed Assertion, Suricata Abort – util-mpm-hs.c line 163
  • Bug #2735: unix runmode deadlock when using too many threads (4.0.x)
  • Bug #2794: Python 3 unicode issue in Rust C header generator on FreeBSD
  • Bug #2824: rule reload with workers mode and NFQUEUE not working stable (4.0.x)
  • Bug #2825: TCP FIN/ACK, RST/ACK in HTTP – detection bypass (4.0.x)
  • Bug #2826: afpacket doesn’t wait for all capture threads to start (4.0.x)
  • Bug #2827: DNS Golden Transaction ID – detection bypass (4.0.x)
  • Bug #2828: Invalid detect-engine config could lead to segfault (4.0.x)
  • Bug #2830: suricata.c ConfigGetCaptureValue – PCAP/AFP fallthrough to strip_trailing_plus (4.0.x)
  • Bug #2831: Stats interval are 1 second too early each tick (4.0.x)
  • Bug #2832: rust/dns/lua – The Lua calls for DNS values when using Rust don’t behave the same as the C implementation. (4.0.x)
  • Bug #2863: out of bounds read in detection
  • Feature #2829: smtp: improve pipelining support (4.0.x)

Special thanks

Philippe Antoine, Alexander Gozman, Fabrice Fontaine, Murat Balaban

Trainings

The 2019 Training Calendar has been posted. There are still seats available for next weeks Advanced Deployment and Threat Hunting training in Washington, D.C. See https://suricata-ids.org/training/

SuriCon

Suricon 2018 was a great success and the 2019 location and dates have been announced: October 30 – November 1, 2019 in Amsterdam. Please consider becoming a sponsor! https://suricon.net/

About Suricata

Suricata is a high performance Network Threat Detection, IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by OISF, its supporting vendors and the community.

Suricata 3.0RC3 Available!

Photo by Eric Leblond

We’re happy to announce Suricata 3.0RC3. RC3 fixes a few issues in RC2 that require some more testing. The plan is to release the stable quickly after the holidays, so please help us test this release!

Fixes:

  • Bug #1632: Fail to download large file with browser
  • Bug #1634: Fix non thread safeness of Prelude analyzer
  • Bug #1640: drop log crashes
  • Bug #1645: Race condition in unix manager
  • Bug #1647: FlowGetKey flow-hash.c:240 segmentation fault (master)
  • Bug #1650: DER parsing issue (master)

Get the release here:

http://www.openinfosecfoundation.org/download/suricata-3.0RC3.tar.gz

Known issues & missing features

In a development release like this things may not be as polished yet. So please handle with care. That said, if you encounter issues, please let us know! As always, we are doing our best to make you aware of continuing development and items within the engine that are not yet complete or optimal. With this in mind, please notice the list we have included of known items we are working on.  See issues for an up to date list and to report new issues. See Known_issues for a discussion and time line for the major issues.

About Suricata

Suricata is a high performance Network IDS, IPS and Network Security Monitoring engine. Open Source and owned by a community run non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by the OISF, its supporting vendors and the community.

Suricata Ubuntu PPA updated to 2.1beta4

We have updated the official Ubuntu PPA to Suricata 2.1beta4. To use this PPA read our docs here.

If you’re using this PPA, updating is as simple as:

apt-get update && apt-get upgrade

The PPA Ubuntu packages have IPS mode through NFQUEUE enabled.

Suricata 2.1beta4 Windows Installer Available

The Windows MSI installer of the Suricata 2.1beta4 release is now available.

Download it here: suricata-2.1beta4-1-32bit.msi

After downloading, double click the file to launch the installer. The installer is now signed.

If you have a previous version installed, please remove that first.

Suricata Ubuntu PPA updated to 2.0.8

We have updated the official Ubuntu PPA to Suricata 2.0.8. To use this PPA read our docs here.

To install Suricata through this PPA, enter:
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
sudo apt-get install suricata

If you’re already using this PPA, updating is as simple as:
sudo apt-get update && sudo apt-get upgrade

The PPA Ubuntu packages have IPS mode through NFQUEUE enabled.

Suricata 2.0.8 Windows Installer Available

The Windows MSI installer of the Suricata 2.0.8 release is now available.

Download it here: Suricata-2.0.8-1-32bit.msi

After downloading, double click the file to launch the installer. The installer is now signed.

If you have a previous version installed, please remove that first.

Suricata Ubuntu PPA updated to 2.0.6

We have updated the official Ubuntu PPA to Suricata 2.0.6. To use this PPA read our docs here.

To install Suricata through this PPA, enter:
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
sudo apt-get install suricata

If you’re already using this PPA, updating is as simple as:
sudo apt-get update && sudo apt-get upgrade

The PPA Ubuntu packages have IPS mode through NFQUEUE enabled.

Suricata 2.0.6 Windows Installer Available

The Windows MSI installer of the Suricata 2.0.6 release is now available.

Download it here: Suricata-2.0.6-1-32bit.msi

After downloading, double click the file to launch the installer. The installer is now signed.

If you have a previous version installed, please remove that first.

Suricata Ubuntu PPA updated to 2.0.5

We have updated the official Ubuntu PPA to Suricata 2.0.5. To use this PPA read our docs here.

To install Suricata through this PPA, enter:
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
sudo apt-get install suricata

If you’re already using this PPA, updating is as simple as:
sudo apt-get update && sudo apt-get upgrade

The PPA Ubuntu packages have IPS mode through NFQUEUE enabled.