Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:11492
HistoryFeb 18, 2006 - 12:00 a.m.

SNORT Incorrect fragmented packet reassembly

2006-02-1800:00:00
vulners.com
8

Snort 2.4.3 has a bug in processing fragmented ip packets which has ip options. frag3 preprocessor of snort
skips [ip_option_length] bytes from end of the ip options when reassembling packet, thus allowing anyone to
evade ids.

Guys at snort.org already informed and are fixing the problem.