Bug 193809 - (CVE-2006-2769) CVE-2006-2769 Snort URIContent Rules Detection Evasion Vulnerability
CVE-2006-2769 Snort URIContent Rules Detection Evasion Vulnerability
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: snort (Show other bugs)
rawhide
All Linux
medium Severity medium
: ---
: ---
Assigned To: Dennis Gilmore
Fedora Extras Quality Assurance
: Reopened, Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-06-01 14:56 EDT by Dennis Gilmore
Modified: 2007-11-30 17:11 EST (History)
2 users (show)

See Also:
Fixed In Version: 2.6.0-1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-06-29 07:34:53 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Dennis Gilmore 2006-06-01 14:56:27 EDT
Snort is reportedly prone to a vulnerability that may allow malicious packets 
to bypass detection. 

A successful attack can allow attackers to bypass intrusion detection and to 
carry out attacks against computers protected by Snort.

This vulnerability affects Snort 2.4.4. Other versions may be vulnerable as 
well.

there is no CVE yet

Demarc snort-2.4.4-demarc-patch.diff
 http://www.demarc.com/files/patch_20060531/snort-2.4.4-demarc-patch.diff
Comment 1 Dennis Gilmore 2006-06-02 11:24:03 EDT
I've applied the supplied patch. 

Fixed in 2.4.4-4 

Hans  would you mind doing an audit of the snort code?  this is the second 
similar vulnerability this year
Comment 2 Dennis Gilmore 2006-06-02 16:08:26 EDT
turns out that the patch is incomplete.
Comment 3 Ville Skyttä 2006-06-03 14:47:44 EDT
FYI: due to rawhide libpcap packaging issues, libpcap may have been statically
linked in in the current devel snort package, see bug 193189 comment 2

One possible workaround: BuildRequire both libpcap and libpcap-devel
Comment 4 Ville Skyttä 2006-06-29 05:48:47 EDT
Ping, status update?
Comment 5 Dennis Gilmore 2006-06-29 07:34:53 EDT
I was looking at thins last night.  I have updated to 2.6.0  since and 
according to snort.org its fixed there

Sourcefire is aware of a possible Snort evasion that exists in the 
http_inspect preprocessor. This evasion case only applies to protected Apache 
web servers. We have prepared fixes for both the 2.4 and 2.6 branches and will 
have fully tested releases, including binaries, available for both on Monday, 
June 5th.
 
 
 Evasion Details:
 
 The Apache web server supports special characters in HTTP requests that do 
not affect the processing of the particular request. The current target-based 
profiles for Apache in the http_inspect preprocessor do not properly handle 
these requests, resulting in the possibility that an attacker can bypass 
detection of rules that use the "uricontent" keyword by embedding special 
characters in a HTTP request.
 
 
 Background Information:
 
 It is important to note that this is an evasion and not a vulnerability. This 
means that while it is possible for an attacker to bypass detection, Snort 
sensors and the networks they protect are not at a heightened risk of other 
attacks.
 
 
 Timeline:
 
 Sourcefire has prepared fixes and is currently finalizing a complete round of 
testing to ensure that the fixes not only solve the issue at hand but do not 
create new bugs as well. The following releases, including binaries for Linux 
and Windows deployments, will be available on Monday, June 5th:
 
 * Snort v2.4.5
 * Snort v2.6.0 final
 
 
 Questions:
 
 Any questions regarding these releases can be sent to 
snort-team@sourcefire.com.

Note You need to log in before you can comment on or make changes to this bug.