Blake Hartstein has reported a vulnerability in Snort, which can be exploited by malicious people to bypass certain security restrictions.
The vulnerability is caused due to an error in the "http_inspect" preprocessor when inspecting HTTP requests that contain a carriage return character at the end of the URL. This can be exploited to bypass detection rules that use the "uricontent" keyword via a specially-crafted HTTP request.
Successful exploitation requires that the protected web server supports special characters in HTTP requests (e.g. Apache web server).
The vulnerability has been reported in versions 2.4.x and 2.6.0 (beta).
Solution: The vulnerability will reportedly be fixed in versions 2.4.5 and 2.6.0 final on 2006-06-05.
Provided and/or discovered by: Blake Hartstein, Demarc Threat Research Team.
Original Advisory: Snort:
Do you have additional information related to this advisory?
Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this
information to firstname.lastname@example.org