Suricata 8.x < 8.0.5 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(318836);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/08");

  script_cve_id(
    "CVE-2026-45752",
    "CVE-2026-45763",
    "CVE-2026-45768",
    "CVE-2026-45770",
    "CVE-2026-46352"
  );
  script_xref(name:"IAVB", value:"2026-B-0147");

  script_name(english:"Suricata 8.x < 8.0.5 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"An IDS/IPS solution running on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of OISF Suricata installed on the remote host is 8.x prior to 8.0.5. It is, therefore, affected by
multiple vulnerabilities, including:

  - LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP,
    crafted traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service.
    (CVE-2026-45768)

  - A Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's
    restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables
    being registered may also cause Suricata to crash. (CVE-2026-45770)

  - Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an
    encapsulated tunnel protocol whose payload is itself fragmented. (CVE-2026-46352)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://github.com/OISF/suricata/security/advisories/GHSA-653j-cc95-vj4c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?92039606");
  # https://github.com/OISF/suricata/security/advisories/GHSA-9h43-frr8-xx6m
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?94f860dd");
  # https://github.com/OISF/suricata/security/advisories/GHSA-cr4x-w4c4-57p7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?581e262b");
  # https://github.com/OISF/suricata/security/advisories/GHSA-qmc9-vqq2-8mv3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0201bf8c");
  # https://github.com/OISF/suricata/security/advisories/GHSA-rc34-46x6-mxxm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9bbf50ca");
  script_set_attribute(attribute:"solution", value:
"Upgrade Suricata to version 8.0.5 or higher.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-45768");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oisf:suricata");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oisf_suricata_win_installed.nbin", "oisf_suricata_nix_installed.nbin");
  script_require_keys("installed_sw/Open Information Security Foundation Suricata");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [ {'scope': 'target', 'match_one': {'os': ['linux', 'windows'] } } ],
  'checks': [
    {
      'product': {'name': 'Open Information Security Foundation Suricata', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version':'8.0.0', 'fixed_version':'8.0.5'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);