Heads up on SNORT

Posted today:

Quote:

---

A vulnerability in Snort has been reported, which potentially can be exploited by malicious people to bypass certain security restrictions.
The vulnerability is caused due to an error in the frag3 preprocessor which causes snort to skip "ip_option_length" bytes from the end of the IP options when reassembling a packet. This can potentially be exploited to bypass signature detection via certain specially-crafted fragmented packets.
The vulnerability has been reported in version 2.4.3. Other versions may also be affected.

---

posted HERE

Cheers:

I'm not seeing this issue anywhere else (SANS, f-Secure, etc.). Has it been verified at other sources you know of?

Thanks.

Quote:

---

Originally posted here by rapier57
I'm not seeing this issue anywhere else (SANS, f-Secure, etc.). Has it been verified at other sources you know of?

Thanks.

---

Still researching, thought I'd post anyways, the site where it is posted has a good rep.


Cheers:

I found it on US-CERT: CVE-2006-0839. References SecurityFocus and a Bugtraq ID: 16705, Feb 17, 2006.

"Currently, we are not aware of any exploits for this vulnerability."

(http://www.us-cert.gov/cas/bulleting...ml#snortbypass)

Quote:

---

Originally posted here by rapier57
I found it on US-CERT: CVE-2006-0839. References SecurityFocus and a Bugtraq ID: 16705, Feb 17, 2006.

"Currently, we are not aware of any exploits for this vulnerability."

(http://www.us-cert.gov/cas/bulleting...ml#snortbypass)

---

Hi rapier57, the link you posted seems to be broke (at least for me it is) can you find it again?

Cheers:

Here it is.

It appears that rapier's link had 'bulletings' in it.. :D

Cheers,

-jk

Ooops, sorry, I was typing it in from another system. Old fingers ... they stumble around.