Suricata 8.x < 8.0.2 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(277498);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/26");

  script_cve_id("CVE-2025-64334", "CVE-2025-64335");
  script_xref(name:"IAVB", value:"2025-B-0201");

  script_name(english:"Suricata 8.x < 8.0.2 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"An IDS/IPS solution running on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of OISF Suricata installed on the remote host is 8.x prior to 8.0.2. It is, therefore, affected by multiple
vulnerabilities:

  - Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the
    Suricata community. In versions from 8.0.0 to before 8.0.2, compressed HTTP data can lead to unbounded memory growth
    during decompression. This issue has been patched in version 8.0.2. A workaround involves disabling LZMA
    decompression or limiting response-body-limit size. (CVE-2025-64334)

  - Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the
    Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is
    used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling
    rules that use entropy in conjunction with base64_data. (CVE-2025-64335)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/OISF/suricata/security/advisories/GHSA-r5jf-v2gx-gx8w
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5f1b4092");
  # https://github.com/OISF/suricata/security/advisories/GHSA-v299-h7p3-q4f2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c117dacb");
  script_set_attribute(attribute:"solution", value:
"Upgrade Suricata to version 8.0.2 or higher.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-64334");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-64335");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oisf:suricata");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oisf_suricata_win_installed.nbin", "oisf_suricata_nix_installed.nbin");
  script_require_keys("installed_sw/Open Information Security Foundation Suricata");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [ {'scope': 'target', 'match_one': {'os': ['linux', 'windows'] } } ],
  'checks': [
    {
      'product': {'name': 'Open Information Security Foundation Suricata', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version':'8.0.0', 'fixed_version':'8.0.2'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);