The default installation of Sourcefire 3D Sensor 1000, 2000, and 9900; and Defense Center 1000; uses the same static, private SSL keys for multiple devices and installations, which allows remote attackers to decrypt SSL traffic via a man-in-the-middle (MITM) attack.
Max CVSS
4.3
EPSS Score
0.30%
Published
2010-06-16
Updated
2018-10-10
The web-based management interfaces in Sourcefire Defense Center (DC) and 3D Sensor before 4.8.2 allow remote authenticated users to gain privileges via a $admin value for the admin parameter in an edit action to admin/user/user.cgi and unspecified other components.
Max CVSS
9.0
EPSS Score
5.41%
Published
2009-07-07
Updated
2018-10-10

CVE-2006-5276

Public exploit
Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire Intrusion Sensor; allows remote attackers to execute arbitrary code via crafted SMB traffic.
Max CVSS
10.0
EPSS Score
71.02%
Published
2007-02-20
Updated
2018-10-17
The HTTP Inspect preprocessor (http_inspect) in Snort 2.4.0 through 2.4.4 allows remote attackers to bypass "uricontent" rules via a carriage return (\r) after the URL and before the HTTP declaration.
Max CVSS
5.0
EPSS Score
1.18%
Published
2006-06-02
Updated
2018-10-18
The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths.
Max CVSS
5.0
EPSS Score
0.71%
Published
2006-02-22
Updated
2018-10-18

CVE-2005-3252

Public exploit
Stack-based buffer overflow in the Back Orifice (BO) preprocessor for Snort before 2.4.3 allows remote attackers to execute arbitrary code via a crafted UDP packet.
Max CVSS
7.5
EPSS Score
94.82%
Published
2005-10-18
Updated
2011-03-08
The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remote attackers to cause a denial of service (crash) via packets with invalid TCP/IP options, which trigger a null dereference.
Max CVSS
7.8
EPSS Score
6.12%
Published
2004-12-31
Updated
2017-07-20
Integer overflow in the TCP stream reassembly module (stream4) for Snort 2.0 and earlier allows remote attackers to execute arbitrary code via large sequence numbers in packets, which enable a heap-based buffer overflow.
Max CVSS
10.0
EPSS Score
16.77%
Published
2003-05-05
Updated
2016-10-18
8 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!