Description
preprocessors/spp_frag3.c in Sourcefire Snort before 2.8.1 does not properly identify packet fragments that have dissimilar TTL values, which allows remote attackers to bypass detection rules by using a different TTL for each fragment.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | snort | 2.7.0-19+lenny1 | DTSA-173-1 |
Advisories 1
- DTSA-173-1 snort - rules bypass Debian Security (DSA / DLA) · Mar 9, 2026
References
- snort-ttl-security-bypass(42584) vdb-entry
- http://cvs.snort.org/viewcvs.cgi/snort/src/preprocessors/spp_frag3.c.diff?r1=text&tr1=1.46.2.4&r2=text&tr2=1.46.2.5&diff_format=h
- FEDORA-2008-4986 vendor-advisory
- 1020081 vdb-entry
- ADV-2008-1602 vdb-entry
- FEDORA-2008-5001 vendor-advisory
- 30348 third-party-advisory
- http://www.ipcop.org/index.php?name=News&file=article&sid=40
- 29327 vdb-entry
- 20080521 Multiple Vendor Snort IP Fragment TTL Evasion Vulnerability third-party-advisory
- http://cvs.snort.org/viewcvs.cgi/snort/ChangeLog?rev=1.534.2.11
- FEDORA-2008-5045 vendor-advisory
- 31204 third-party-advisory
- 30563 third-party-advisory