Sign-up

ID

VAR-200602-0404


CVE

CVE-2006-0839


TITLE

Snort Frag3 Processor Packet Fragment Avoidance Detection Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2006-0996

DESCRIPTION

The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths. Snort is reportedly prone to a vulnerability that may allow malicious packets to bypass detection. Reports indicate that the Frag3 preprocessor fails to properly analyze certain packets. A successful attack can allow attackers to bypass intrusion detection and to carry out attacks against computers protected by Snort. This vulnerability affects Snort 2.4.3. Other versions may be vulnerable as well. TITLE: Snort frag3 Preprocessor Packet Reassembly Vulnerability SECUNIA ADVISORY ID: SA18959 VERIFY ADVISORY: http://secunia.com/advisories/18959/ CRITICAL: Moderately critical IMPACT: Security Bypass WHERE: >From remote SOFTWARE: Snort 2.4.x http://secunia.com/product/5691/ DESCRIPTION: siouxsie has reported a vulnerability in Snort, which potentially can be exploited by malicious people to bypass certain security restrictions. The vulnerability has been reported in version 2.4.3. SOLUTION: Filter potentially malicious fragmented IP packets with a firewall. PROVIDED AND/OR DISCOVERED BY: siouxsie ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.8

sources: NVD: CVE-2006-0839 // CNVD: CNVD-2006-0996 // BID: 16705 // PACKETSTORM: 44230

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2006-0996

AFFECTED PRODUCTS

vendor:sourcefiremodel:snortscope:eqversion:2.4.3

Trust: 1.6

vendor:nomodel: - scope: - version: -

Trust: 0.6

vendor:snortmodel:project snortscope:eqversion:2.4.3

Trust: 0.3

sources: CNVD: CNVD-2006-0996 // BID: 16705 // CNNVD: CNNVD-200602-339 // NVD: CVE-2006-0839

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-0839
value: MEDIUM

Trust: 1.0

CNVD: CNVD-2006-0996
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-200602-339
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2006-0839
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

CNVD: CNVD-2006-0996
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2006-0996 // CNNVD: CNNVD-200602-339 // NVD: CVE-2006-0839

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-0839

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200602-339

TYPE

Design Error

Trust: 0.9

sources: BID: 16705 // CNNVD: CNNVD-200602-339

EXTERNAL IDS

db:BIDid:16705

Trust: 2.5

db:NVDid:CVE-2006-0839

Trust: 2.2

db:SECUNIAid:18959

Trust: 1.7

db:CNVDid:CNVD-2006-0996

Trust: 0.6

db:XFid:3

Trust: 0.6

db:XFid:24811

Trust: 0.6

db:BUGTRAQid:20060217 SNORT INCORRECT FRAGMENTED PACKET REASSEMBLY

Trust: 0.6

db:CNNVDid:CNNVD-200602-339

Trust: 0.6

db:PACKETSTORMid:44230

Trust: 0.1

sources: CNVD: CNVD-2006-0996 // BID: 16705 // PACKETSTORM: 44230 // CNNVD: CNNVD-200602-339 // NVD: CVE-2006-0839

REFERENCES

url:http://www.securityfocus.com/bid/16705

Trust: 2.2

url:http://secunia.com/advisories/18959

Trust: 1.6

url:http://www.securityfocus.com/archive/1/425290/100/0/threaded

Trust: 1.0

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/24811

Trust: 1.0

url:http://www.securityfocus.com/archive/1/archive/1/425290/100/0/threaded

Trust: 0.6

url:http://xforce.iss.net/xforce/xfdb/24811

Trust: 0.6

url:http://www.snort.org/

Trust: 0.3

url:/archive/1/425290

Trust: 0.3

url:http://secunia.com/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://secunia.com/product/5691/

Trust: 0.1

url:http://secunia.com/advisories/18959/

Trust: 0.1

url:http://secunia.com/about_secunia_advisories/

Trust: 0.1

sources: CNVD: CNVD-2006-0996 // BID: 16705 // PACKETSTORM: 44230 // CNNVD: CNNVD-200602-339 // NVD: CVE-2006-0839

CREDITS

Reported by

Trust: 0.6

sources: CNNVD: CNNVD-200602-339

SOURCES

db:CNVDid:CNVD-2006-0996
db:BIDid:16705
db:PACKETSTORMid:44230
db:CNNVDid:CNNVD-200602-339
db:NVDid:CVE-2006-0839

LAST UPDATE DATE

2024-08-14T12:48:28.666000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2006-0996date:2006-02-21T00:00:00
db:BIDid:16705date:2006-02-17T18:43:00
db:CNNVDid:CNNVD-200602-339date:2006-08-24T00:00:00
db:NVDid:CVE-2006-0839date:2018-10-18T16:29:23.023

SOURCES RELEASE DATE

db:CNVDid:CNVD-2006-0996date:2006-02-21T00:00:00
db:BIDid:16705date:2006-02-17T00:00:00
db:PACKETSTORMid:44230date:2006-03-01T03:50:51
db:CNNVDid:CNNVD-200602-339date:2006-02-21T00:00:00
db:NVDid:CVE-2006-0839date:2006-02-22T02:02:00