[SECURITY] Fedora 7 Update: snort-2.8.1-3.fc7

Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network intrusion detection system. It features rules based logging and can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,...

[SECURITY] Fedora 8 Update: snort-2.8.1-3.fc8

Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network intrusion detection system. It features rules based logging and can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,...

[SECURITY] Fedora 9 Update: snort-2.8.1-3.fc9

Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network intrusion detection system. It features rules based logging and can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,...

Snort碎片重组TTL值导致漏报漏洞

BUGTRAQ ID: 29327 CVECAN ID: CVE-2008-1804 Snort是广泛部署的开放源码网络入侵检测系统（IDS）。 Snort没有正确地重组IP报文，远程攻击者可能利用此漏洞绕过检测。 在接收入站碎片时，Snort检查碎片的存活时间（TTL）值并与初始碎片的TTL做比较。如果二者之间的差异大于所配置的量（默认最大值为5）的话，就会丢弃碎片，也无法对其应用规则，这导致Snort无法过滤或检查有效的通讯。 Snort Project Snort 2.8 Snort Project Snort 2.6 临时解决方法：...

Design/Logic Flaw

preprocessors/sppfrag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment...

CVE-2008-1804

preprocessors/sppfrag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment...

CVE-2008-1804

preprocessors/sppfrag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment...

CVE-2008-1804

preprocessors/sppfrag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment...

CVE-2008-1804

CVE-2008-1804 targets Sourcefire Snort up to version 2.8.0: the preprocessor spp_frag3.c fails to correctly identify packet fragments with dissimilar TTL values, enabling a remote attacker to bypass detection rules by using different TTLs on each fragment. The issue is tied to Snort’s fragment-ha...

CVE-2008-1804

Removed by vendor...

CVE-2008-1804

preprocessors/sppfrag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment...

snort IDS protection bypass

Packet's fragments with significant TTL difference are ignored...

iDefense Security Advisory 05.21.08: Multiple Vendor Snort IP Fragment TTL Evasion Vulnerability

iDefense Security Advisory 05.21.08 http://labs.idefense.com/intelligence/vulnerabilities/ May 21, 2008 I. BACKGROUND Snort is an open source network intrusion detection IDS and prevention system IPS. In addition to being available as a package for most Unix operating system distributions, variou...

Debian: Security Advisory (DSA-297)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 297-1 (snort)

The remote host is missing an update to snort announced via advisory DSA 297-1. OpenVAS Vulnerability Test $Id: deb2971.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 297-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Fedora 7 : snort-2.7.0.1-3.fc7 (2007-2060)

This build moves from manual linking to alternatives. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

openSUSE 10 Security Update : snort (snort-1598)

This update fixes an evasion attack on URL parsing. The faulty code is in the httpinspect preprocessor. CVE-2006-2769 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update snort-1598. The text...

[SECURITY] Fedora 7 Update: snort-2.7.0.1-3.fc7

Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network intrusion detection system. It features rules based logging and can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows,...

Snort Back Orifice Pre-Processor buffer overflow

Added: 08/28/2007 CVE: CVE-2005-3252 BID: 15131 OSVDB: 20034 Background Back Orifice is a remote system administration program for Windows. It is commonly installed by attackers or Trojan Horse programs for use as a backdoor. Snort is an open-source intrusion detection system. It includes a Back...

Snort Back Orifice Pre-Processor buffer overflow

Added: 08/28/2007 CVE: CVE-2005-3252 BID: 15131 OSVDB: 20034 Background Back Orifice is a remote system administration program for Windows. It is commonly installed by attackers or Trojan Horse programs for use as a backdoor. Snort is an open-source intrusion detection system. It includes a Back...