Snort Frag3 Processor Fragmented Packet Detection Evasion Vulnerability

Bugtraq ID:	16705
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 17 2006 12:00AM
Updated:	Feb 17 2006 06:43PM
Credit:	Reported by <[email protected]>.
Vulnerable:	Snort Project Snort 2.4.3
Not Vulnerable:

Snort Frag3 Processor Fragmented Packet Detection Evasion Vulnerability


Snort is reportedly prone to a vulnerability that may allow malicious packets to bypass detection.

Reports indicate that the Frag3 preprocessor fails to properly analyze certain packets.

A successful attack can allow attackers to bypass intrusion detection and to carry out attacks against computers protected by Snort.

This vulnerability affects Snort 2.4.3. Other versions may be vulnerable as well.

Snort Frag3 Processor Fragmented Packet Detection Evasion Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Snort Frag3 Processor Fragmented Packet Detection Evasion Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Snort Frag3 Processor Fragmented Packet Detection Evasion Vulnerability

References:

• Snort Homepage (Snort Project)
  
• SNORT Incorrect fragmented packet reassembly ([email protected])