preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment.

preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment. (CVE-2008-1804)

The updated packages have been patched to prevent this.

Additionally there were problems with two rules in the snort-rules package for 2008.0 that is also fixed with this update.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

Fix for CVE-2008-1804

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update for CVE-2008-1804

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
42063	Mandriva Linux Security Advisory : snort (MDVSA-2009:259-1)	Nessus	Mandriva Local Security Checks	medium
33117	Fedora 7 : snort-2.8.1-3.fc7 (2008-5045)	Nessus	Fedora Local Security Checks	medium
33114	Fedora 8 : snort-2.8.1-3.fc8 (2008-5001)	Nessus	Fedora Local Security Checks	medium
33112	Fedora 9 : snort-2.8.1-3.fc9 (2008-4986)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-1804

high

Tenable Plugins

medium

medium

medium

medium