Snort碎片重组TTL值导致漏报漏洞

BUGTRAQ ID: 29327 CVECAN ID: CVE-2008-1804 Snort是广泛部署的开放源码网络入侵检测系统（IDS）。 Snort没有正确地重组IP报文，远程攻击者可能利用此漏洞绕过检测。 在接收入站碎片时，Snort检查碎片的存活时间（TTL）值并与初始碎片的TTL做比较。如果二者之间的差异大于所配置的量（默认最大值为5）的话，就会丢弃碎片，也无法对其应用规则，这导致Snort无法过滤或检查有效的通讯。 Snort Project Snort 2.8 Snort Project Snort 2.6 临时解决方法：...

CVE-2008-1804

preprocessors/sppfrag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment...

Design/Logic Flaw

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

CVE-2008-1095

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

CVE-2008-1095

CVE-2008-1095 affects the Internet Protocol (IP) implementation in Sun Solaris 8, 9, and 10. The vulnerability is described as an unspecified issue that allows remote attackers to bypass firewall policies or cause a denial of service (panic) via unknown vectors, with possible involvement of ICMP ...

CVE-2008-1095: Undefined Security Weakness

Unspecified vulnerability in the Internet Protocol IP implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service panic via unknown vectors, possibly related to ICMP packets and IP fragment reassembly...

CVE-2008-0372

8e6 R3000 Internet Filter 2.0.05.33, and other versions before 2.0.11, allows remote attackers to bypass intended restrictions via a fragmented HTTP request...

Debian Security Advisory DSA 332-1 (kernel-source-2.4.17, kernel-patch-2.4.17-mips)

The remote host is missing an update to kernel-source-2.4.17, kernel-patch-2.4.17-mips announced via advisory DSA 332-1. OpenVAS Vulnerability Test $Id: deb3321.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 332-1 Authors: Thomas Reinke Copyright: Copyrigh...

FortiGuard URL filtering protection bypass

It's possible to bypass filtering by removing Host:header from HTTP request of by fragmenting request...

Linux Kernel Netfilter nf_conntrack IPv6报文重组绕过规则漏洞

Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel中netfilter的模块实现上存在漏洞，远程攻击者可能利用此漏洞绕过访问过滤。 netfilter的nfconntrack函数在重组碎片IPv6报文期间没有设置nfctinfo，将默认值初始化为0，而这是IPCTESTABLISHED的值，因此所有IPv6碎片都追踪为ESTABLISHED，这样攻击者就可以绕过某些接受ESTABLISHED报文的规则组。 Linux kernel 2.6.20.3 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Snort Inline模式碎片重组拒绝服务漏洞

Snort是广泛部署的开放源码网络入侵检测系统（IDS）。很多其他IDS产品中也使用了Snort及其组件。 Snort Inline在处理畸形的碎片报文时存在漏洞，远程攻击者可能利用此漏洞导致Snort崩溃。 如果在Linux平台上以Inline模式运行Snort的话，且启用了Frag3同时禁用了ipconntrack，则如果向Snort发送了特制的碎片报文的话就会导致拒绝服务。 Snort Project Snort 2.7.0 beta 1 Snort Project Snort 2.6.1.2 Snort Project Snort 2.6.1.1...

PT-2007-1571

Name of the Vulnerable Software and Affected Versions Apache HTTP Server affected versions not specified Description The issue allows remote attackers to cause a denial of service, consuming network bandwidth, via a Range header that specifies multiple copies of the same fragment when accessed...

PT-2006-5360 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.16.31 Description: The issue allows remote attackers to bypass rules in ip6 tables in netfilter. This can be achieved in two ways: 1 by sending a packet with the protocol header not located immediately after...

CVE-2006-4572

ip6tables in netfilter in the Linux kernel before 2.6.16.31 allows remote attackers to 1 bypass a rule that disallows a protocol, via a packet with the protocol header not located immediately after the fragment header, aka "ip6tables protocol bypass bug;" and 2 bypass a rule that looks for a...

Mozilla Firefox Range脚本对象拒绝服务漏洞

Firefox是一款开放源码的WEB浏览器。 Firefox的Range对象中存在空指针引用问题，成功利用这个漏洞的攻击者可以导致浏览器崩溃。 可以使用selectNode方式初始化Range对象选择将要注入Range中的节点，也可以使用createContextualFragment方式创建文档碎片，如下所示： var tagString = "divI am a div node/div"; var range = document.createRange; range.selectNodedocument.getElementsByTagName"div".item0; var...

DEBIAN-CVE-2006-5633

Firefox 1.5.0.7 and 2.0, and Seamonkey 1.1b, allows remote attackers to cause a denial of service crash by creating a range object using createRange, calling selectNode on a DocType node DOCUMENTTYPENODE, then calling createContextualFragment on the range, which triggers a null dereference. NOTE:...

CVE-2006-5479: Undefined Security Weakness

The NCP Engine in Novell eDirectory before 8.7.3.8 FTF1 allows remote attackers to cause an unspecified denial of service via a certain "NCP Fragment."...

[Full-disclosure] Microsoft SMB Information Disclosure Vulnerability CVE-2006-1315

McAfee, Inc. McAfee® Avert® Labs Security Advisory Public Release Date: 2006-07-11 SMB Information Disclosure Vulnerability CVE-2006-1315 • Synopsis An information disclosure vulnerability exists in the Server service that could allow an attacker to retrieve fragments of memory from an affected...

CentOS 3 : kernel (CESA-2005:293)

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of the operating syste...

CVE-2006-1195

The enetprotocolhandlesendfragment function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including 1 Cube, 2 Sauerbraten, and 3 Duke3dw32, allows remote attackers to cause a denial of service application crash via a packet fragment with a large total data...