Question on stream4 preprocessor

[sgt_b <sgt_b () security-forums com>]

Hey everyone,

Let's say an exploit is sent from one host to another, one byte at a 
time. It's the stream4_reassemble preprocessor's job to reassemble each 
byte of that session into its intended form, and pass that down to the 
detection engine. From there the exploit attempt should be detected by 
snort.
I've tested this, and it works of course.
Here's my question though. As each packet is sent over the wire snort 
picks it up one packet at a time. Each packet along the stream is sent 
to the detection engine as well. If one of these packets triggers an 
alert, what is supposed to happen?

From what I've read, it looks to me like there should be an alert 
generated for that packet, as well as the entire stream once the session 
is reassembled by stream4.

In practice though, I've noticed some different behavior. In testing 
Nessus's Injection TCP NIDS evasion feature, I've notcied some 
inconsistencies in Snort's reactions.
I'm testing this using the Apache Chunked encodiing vulnerability 
plugin. Utilizing the Injection method, Nessus will send the exploit to 
the webserver one character at a time (ie G in one packet, E in the 
next, T in another, etc) along with garbage packets in between.

Snort will alert on any of the valid packets that only contain a '.' or 
|20| as a libwhisker space splicing attempt. It will not however send 
any alerts regarding the Chunked Encoding vulnerability.
At first I questioned stream4, but if I disable the libwhisker rule, 
stream4 reassembles the packet just fine, and an alert is issued for the 
chunked encoding vulnerability.

Shouldn't two alerts be issued though? One for the libwhisker attempt, 
and once the stream is reassembled, one for the chunked encoding 
vulnerability?



-------------------------------------------------------
This SF.Net email is sponsored by: Oracle 10g
Get certified on the hottest thing ever to hit the market... Oracle 10g. 
Take an Oracle 10g class now, and we'll give you the exam FREE. 
http://ads.osdn.com/?ad_id=3149&alloc_id=8166&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users