OSVDB ID: 25837

Title: Snort HTTP Inspect Pre-Processor Uricontent Bypass

Info

Disclosure
May 31, 2006

Discovery
May 17, 2006

Dates

Exploit
May 31, 2006

Solution
Unknown

Description

 Snort contains a flaw that may allow a remote attacker to bypass IDS detection. The issue is triggered by adding a carriage return to the end of a URL, directly before the HTTP protocol declaration. It is possible that the flaw may allow bypass detection of "uricontent" rules resulting in a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Third-Party Solution
Exploit: Exploit Public
Disclosure: OSVDB Verified, Vendor Verified
OSVDB: Security Software

Solution

 Currently, there are no known workarounds or upgrades to correct this issue. However, Demarc Threat Research Team has released an unofficial patch to address this vulnerability.

Products

Sourcefire, Inc.

Snort

 2.4.0
2.4.1
2.4.2
2.4.3
2.4.4

References

Credit
  • Blake Hartstein - bhartsteindemarc.com - Demarc Threat Research Team


Direct URL: http://osvdb.org/25837