Snort - white space vulnerability.

THE SPLOIT DETAILS
======================
Before I begin, this vulnerability is not specific to Snort alone. There are many IDS systems that are still using fixed strings to identify "bad" traffic. However, many others are doing the right thing and are stripping out white spaces and backspaces *before* applying their rule set.

PLATFORM
=====================
RedHat 8.0 with all the latest patches
Snort 1.9.1

WHAT I DID
======================
Telnet to SMTP server and added one additional space to the MAIL FROM command. (I wont post the actual command as security pros here know exactly what commands I'm using).

WHAT SNORT DID
======================
When adding the extra white space, snort was more than happy to allow the traffic through. Now, I know that myself and others have reported this to the snort developers a *long* time ago but the fix would require a ton of development work.

Snort is a very good freeware tool but now that commercial IDS companies have started shipping whitespace and backspace aware IDS systems, I'd certainly invest a few bucks in one.

Hope this helps out!
:p

Nice. Very helpful and interesting. I wonder though, did the snort developers comment on this at all?

Cheers.

Yes, the first time I reported this, they told me that in order to fix this, they would need to rewrite much of the engine. They also said that the task at hand for just 3 developers would be daunting and they didn't expect to fix it quickly. This was about a year ago. Since then, I always test new releases of snort for this issue. I think that my next step is to fire something off to BugTraq but I will wait for the next release before doing so.
;)

not to bug ya, but the whitespace thing...
where is the whitespace included, before / after / inside the targeted data?
you mentioned backspaces, is it just spaces/backspaces- or is it any blank character (null, bell, etc...) thanx for the info- as i use snort for my IDS ... any know ways to protect against?

btw- much propers on the find !

I put the whitespaces in between "MAIL FROM". This works for white spaces and backspaces and there is no fix available.

Sorry to bring ya that little bit of bad news Tampa :(