[security-alerts] FW: [SA20413] Snort "http_inspect" Preprocessor Bypass Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> Snort "http_inspect" Preprocessor Bypass Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA20413
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/20413/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> Security Bypass
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> Snort 2.4.x
> http://secunia.com/product/5691/
> 
> DESCRIPTION:
> Blake Hartstein has reported a vulnerability in Snort, which can be
> exploited by malicious people to bypass certain security
> restrictions.
> 
> The vulnerability is caused due to an error in the "http_inspect"
> preprocessor when inspecting HTTP requests that contain a carriage
> return character at the end of the URL. This can be exploited to
> bypass detection rules that use the "uricontent" keyword via a
> specially-crafted HTTP request.
> 
> Successful exploitation requires that the protected web server
> supports special characters in HTTP requests (e.g. Apache web
> server).
> 
> The vulnerability has been reported in versions 2.4.x and 2.6.0
> (beta).
> 
> SOLUTION:
> The vulnerability will reportedly be fixed in versions 2.4.5 and
> 2.6.0 final on 2006-06-05.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Blake Hartstein, Demarc Threat Research Team.
> 
> ORIGINAL ADVISORY:
> Snort:
> http://www.snort.org/pub-bin/snortnews.cgi#431
> 
> Demarc:
> http://www.demarc.com/support/downloads/patch_20060531
>