CVE-2004-2652: sourcefire snort
Vulnerability summary
CVE-2004-2652 is a high (CVSS 7.8) vulnerability in sourcefire snort. EPSS estimates a 11.19% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities. 7 public exploits are recorded.
Timeline
- 18-12-2005PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remote attackers to cause a denial of service (crash) via packets with invalid TCP/IP options, which trigger a null dereference.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
11.19%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 11.19% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
7 foundExploit Reference (securitytracker.com)
Maturity: unknown
Exploit Reference (securityfocus.com)
Maturity: unknown
Exploit Reference (securiteam.com)
Maturity: unknown
Show all 7 exploits
Exploit Reference (osvdb.org)
Maturity: unknown
Exploit Reference (taosecurity.blogspot.com)
Maturity: unknown
Snort 2.1/2.2 - DecodeTCPOptions Remote Denial of Service (1)
Maturity: poc
Snort 2.1/2.2 - DecodeTCPOptions Remote Denial of Service (2)
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Sourcefire1 product
- snort2.1.0 | 2.1.1_rc1 | 2.1.3 | 2.2
1 vendor · 1 product
References
9 links- www.frsirt.com/exploits/20041222.angelDust.c.phpX Refsource MISC
- www.snort.org/arc_news/X Refsource CONFIRM
- taosecurity.blogspot.com/2004/12/details-on-snort-dos-condition-you-may.htmlX Refsource MISCExploitVendor Advisory