[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
SNORT Incorrect fragmented packet reassembly
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: SNORT Incorrect fragmented packet reassembly
- From: siouxsie@xxxxxxxxxxxx
- Date: 17 Feb 2006 14:51:46 -0000
Snort 2.4.3 has a bug in processing fragmented ip packets which has ip options.
frag3 preprocessor of snort skips [ip_option_length] bytes from end of the ip
options when reassembling packet, thus allowing anyone to evade ids.
Guys at snort.org already informed and are fixing the problem.