CVE-2008-1804

Severity

68%

Complexity

86%

Confidentiality

106%

preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment.

preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment.

CVSS 2.0 Base Score 6.8. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P).

Overview

First reported 17 years ago

2008-05-22 13:09:00

Last updated 7 years ago

2017-08-08 01:30:00

Affected Software

Snort Snort

References

http://cvs.snort.org/viewcvs.cgi/snort/ChangeLog?rev=1.534.2.11

http://cvs.snort.org/viewcvs.cgi/snort/src/preprocessors/spp_frag3.c.diff?r1=text&tr1=1.46.2.4&r2=text&tr2=1.46.2.5&diff_format=h

20080521 Multiple Vendor Snort IP Fragment TTL Evasion Vulnerability

30348

30563

31204

1020081

http://www.ipcop.org/index.php?name=News&file=article&sid=40

29327

ADV-2008-1602

snort-ttl-security-bypass(42584)

FEDORA-2008-4986

FEDORA-2008-5001

FEDORA-2008-5045

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.