Snort contains a flaw that may allow a remote attacker to bypass IDS detection. The issue is triggered by adding a carriage return to the end of a URL, directly before the HTTP protocol declaration. It is possible that the flaw may allow bypass detection of "uricontent" rules resulting in a loss of integrity.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Third-Party Solution
Exploit:
Exploit Public
Disclosure:
Vendor Verified
OSVDB:
Security Software
Solution
Currently, there are no known workarounds or upgrades to correct this issue. However, Demarc Threat Research Team has released an unofficial patch to address this vulnerability.
demarc.com -
Demarc Threat Research Team
