Snort_Inline Rule 2077 Failure Vulnerability

Bugtraq ID:	9415
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 13 2004 12:00AM
Updated:	Jan 13 2004 12:00AM
Credit:	Discovery of this vulnerability has been credited to Federico Petronio <[email protected]>.
Vulnerable:	snort_inline snort_inline 2.0.1
Not Vulnerable:

Snort_Inline Rule 2077 Failure Vulnerability

snort_inline has been reported prone to a vulnerability. The issue is said to occur when snort_inline is configured so that the action for a certain rule is to drop the packets. It has been reported that regardless of this rule after a period of time has elapsed snort_inline will permit this traffic, even though this traffic is supposedly categorically denied.

Snort_Inline Rule 2077 Failure Vulnerability

There is no exploit required. An attacker may simply make requests that are sufficient to exploit the issue described in BID 6572 to the vulnerable server that is protected by snort_inline.

Snort_Inline Rule 2077 Failure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Snort_Inline Rule 2077 Failure Vulnerability

References:

• snort_inline Homepage (snort_inline)
  
• Snort-inline (Federico Petronio )