CVE-2008-1804 preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using...
MediumCVSS 6.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| snort | <= 2.8.0 | No fix listed |
| debian/snort(Debian:11) | < 2.7.0-20 | 2.7.0-20 |
References
- cvs.snort.org
- cvs.snort.org
- 20080521 Multiple Vendor Snort IP Fragment TTL Evasion Vulnerability third-party-advisory
- 30348 third-party-advisory vendor-advisory
- 30563 third-party-advisory vendor-advisory
- 31204 third-party-advisory vendor-advisory
- 1020081 vdb-entry
- www.ipcop.org
- 29327 vdb-entry
- ADV-2008-1602 vdb-entry vendor-advisory
- snort-ttl-security-bypass(42584) vdb-entry
- FEDORA-2008-4986 vendor-advisory
- FEDORA-2008-5001 vendor-advisory
- FEDORA-2008-5045 vendor-advisory
- security-tracker.debian.org vendor-advisory