CVE-2019-10051 : An issue was discovered in Suricata 4.1.3. If the function filetracker_newchunk encounters an unsafe "Some(sfcm) => { ft

An issue was discovered in Suricata 4.1.3. If the function filetracker_newchunk encounters an unsafe "Some(sfcm) => { ft.new_chunk }" item, then the program enters an smb/files.rs error condition and crashes.

Published 2019-08-28 20:15:10

Updated 2019-09-05 15:35:23

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-10051

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 65 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-10051

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2019-10051

CWE-754 Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-10051

https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/

Suricata 4.1.4 released | Suricata
Not Applicable;Release Notes;Vendor Advisory

CVEs referencing this url
https://redmine.openinfosecfoundation.org/issues/2896

Bug #2896: smb 1 create andx request does not parse the filename correctly (master) - Suricata - Open Information Security Foundation
Exploit;Issue Tracking;Third Party Advisory
https://github.com/OISF/suricata/pull/3734

Fix parsing of smb1 create andx request filename by wesleyvanderree · Pull Request #3734 · OISF/suricata · GitHub
Exploit;Patch;Third Party Advisory

Products affected by CVE-2019-10051

Suricata-ids » Suricata » Version: 4.1.3
cpe:2.3:a:suricata-ids:suricata:4.1.3:*:*:*:*:*:*:*
Matching versions
Suricata-ids » Suricata » Version: 4.1.4
cpe:2.3:a:suricata-ids:suricata:4.1.4:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2019-10051

Exploit prediction scoring system (EPSS) score for CVE-2019-10051

CVSS scores for CVE-2019-10051

CWE ids for CVE-2019-10051

References for CVE-2019-10051

Products affected by CVE-2019-10051