Vulnerability Development: Re: snort crash ...

[MMS26 <mms () SPEAKEASY ORG>]

On Tue, 1 Aug 2000, Fyodor wrote:

> We don't handle igmp nor anything else except for udp, tcp and icmp in any
> kind of specific way. The problem which has been spotted `sits' in
> defragmentation preprocessor which is still beta anyway :).
>
> Marty  has fixed some issues  with icmp handling as well and these have
> been integrated into version 1.6.3. I am currently trying to integrate
> those fixes into current version as well, and it should show up in cvs
> tree as soon as I am done.
sorry for the crosspost... i am still unclear as to why snort 1.6.3 needs
to open a raw socket at all... regardless of its lack of igm usage...

MMS26