Unscored severity · published Feb 22, 2006
CVE-2006-0839
The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of…
–
CVSS
1.4%
EPSS
No
On KEV
Description
The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
Snort · Sourcefire
2.4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0839
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0839
secunia.com
http://secunia.com/advisories/18959
www.securityfocus.com
http://www.securityfocus.com/archive/1/425290/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/16705
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/24811
More from Snort
–
CVE-2006-2769
The HTTP Inspect preprocessor (http_inspect) in Snort 2.4.0 through 2.4.4 allows remote attackers to bypass "uricontent" rules via a carriage return (\r) after the URL and before…
–
CVE-2005-3252
Stack-based buffer overflow in the Back Orifice (BO) preprocessor for Snort before 2.4.3 allows remote attackers to execute arbitrary code via a crafted UDP packet
–
CVE-2004-2652
The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remote attackers to cause a denial of…
–
CVE-2003-0209
Integer overflow in the TCP stream reassembly module (stream4) for Snort 2.0 and earlier allows remote attackers to execute arbitrary code via large sequence numbers in packets,…