bugtraq - Snort HTTP Inspect Pre-Processor Uricontent Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <fc9d412a0605311719x1da6bd03m1041cb342e44cd3c@mail.gmail.com>
Date: Wed, 31 May 2006 17:19:41 -0700
From: "Christian Swartzbaugh" <feofil@...il.com>
To: bugtraq@...urityfocus.com
Subject: Snort HTTP Inspect Pre-Processor Uricontent Bypass

For those of you using snort on this list, this got posted to some of
the snort mailing lists this morning.

http://www.demarc.com/support/downloads/patch_20060531
http://www.osvdb.org/25837

"The evasion technique allows an attack to bypass detection of
"uricontent" rules by
adding a carriage return to the end of a URL, directly before the HTTP protocol
declaration.
This affects thousands of rules in the standard Snort base rule sets.

Due to the seriousness of this vulnerability, we have developed a
working patch for
public review. See below.
This patch addresses the carriage return bug and should catch the known evasion
attempts but further research needs to be done to determine if there
are any other

possible impacts of this bug. The detection for evasion is turned on
by default under
all profiles but can also be used as a server configuration option:
-----HTTP Inspect Server Configuration-----

non_std_cr <yes|no>

This option generates an alert when a non standard carriage return character is
detected in the URI.
-----end-----

More information including a pre-patched tarball, a simple proof of
concept, and a

copy of this patch ..."

feofil