Snort Evasion Echo Flag Port Scan Vulnerability

Bugtraq ID:	7220
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 28 2003 12:00AM
Updated:	Mar 28 2003 12:00AM
Credit:	Discovery credited to "Toby Miller" <[email protected]>.
Vulnerable:	Snort Project Snort 1.9.1 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Multi Network Firewall 2.0 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + Mandriva Linux Mandrake 9.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2
Not Vulnerable:	Snort Project Snort 2.0 .0rc1

Snort Evasion Echo Flag Port Scan Vulnerability

It has been reported that a vulnerability exists in the default configuration of Snort. Due to this issue, it is possible for a user to evade detection while port scanning hosts.

Snort Evasion Echo Flag Port Scan Vulnerability

Solution:
It has been reported that this vulnerability is fixed in version 2.0rc1. This information has not yet been confirmed by the vendor.


Snort Project Snort 1.9.1

• Snort Project snort-2.0.0rc1.tar.gz
  http://www.snort.org/dl/snort-2.0.0rc1.tar.gz

Snort Evasion Echo Flag Port Scan Vulnerability

References:

• Snort Homepage (Snort Project)
  
• Problems with Snort-1.9.1 ("Toby Miller" )