SecuriTeam"! - Multiple Vendor Snort IP Fragment TTL Evasion Vulnerability

SnortにIPフラグメントを起こして検知から逃れようという感じみたいです。

パケットのTTL値を見てフラグメントをチェックしているけど、TTLを変えることでSnortフィルタをかいくぐれるみたいです

Due to a design error vulnerability, Snort does not properly reassemble fragmented IP packets. When receiving incoming fragments, Snort checks the Time To Live (TTL) value of the fragment, and compares it to the TTL of the initial fragment. If the difference between the initial fragment and the following fragments is more than a configured amount, the fragments will be silently discard. This results in valid traffic not being examined and/or filtered by Snort.

---