Bugtraq mailing list archives

SNORT Incorrect fragmented packet reassembly

From: siouxsie () entheogen ru
Date: 17 Feb 2006 14:51:46 -0000

Snort 2.4.3 has a bug in processing fragmented ip packets which has ip options. frag3 preprocessor of snort skips 
[ip_option_length] bytes from end of the ip options when reassembling packet, thus allowing anyone to evade ids.

Guys at snort.org already informed and are fixing the problem.

Current thread:

SNORT Incorrect fragmented packet reassembly siouxsie (Feb 17)