Snort 2.9.20

New Additions:
Added support for AppID to detect login success and failure for IMAP and POP3 protocols.
Improvements / Fix:
Fixed an issue where the verdict will be applied to the next session when a timeout occurs in some scenarios.
Removed an excessively flooding log.
Fixed possible integer overflow.
Added fix to GCC compiled snort to use AC-BNFA-Q search-method when Intel-CPM is enabled.
Fixed terminology to be bias-free in log/error messages.
Fixed a potential race condition.
Added fix to not to drop packets when the window size is 0 by TCP normalizer and added a new alert with GID 129 and SID 21 when such packets are seen.

Fixed possible memory corruption in SMB preprocessor.

New Additions:
Added range field support in HTTP preprocessor.
Added alert for HTTP chunk size mismatch.
Added support to detect SNMP 'report pdu'.
Added additional stats for SMB preprocessor.
Improvements and fixes:
Fixed a condition in which an alert would not be generated.
Fixed possible memory corruption in SMB preprocessor.
Fixed handling ICMP error code -4 .
Fixed an error when the debugmsgs option enabled in compilation.

New Additions

• Added support for glibc version 2.30.

Improvements/Fix

• Fixed Snort core seen during SSL re-configuration.
• Fixed file access issues on files from SMB share.

[*] Improvements
* Stability improvement for Stream6 preprocessor

* Fixed multiple issues in HttpInspect preprocessor

* Fixed an issue of incorrect masking of sensitive data

NEW ADDITIONS:
SMBv2/SMBv3 support for file inspection.
Port override for metadata service in IPS rules.
AppID Lua detector performance profiling.
Perfmon dumps stats at fixed intervals from absolute time.
New preprocessor alert (120:18) to detect SSH tunneling over HTTP
New config option |disable_replace| to disable replace rule option.
New Stream configuration |log_asymmetric_traffic| to control logging to syslog.
New shell script in tools to create simple Lua detectors for AppID.
IMPROVEMENTS:
sfip_t refactored to use struct in6_addr for all ip addresses.
Post-detection callback for preprocessors.
AppID support for multiple server/client detectors evaluating on same flow.
AppID API for DNS packets.
Memory optimizations throughout.
Support sending UDP active responses.
Fix perfmon tracking of pruned packets.
Stability improvements for AppID.
Stability improvements for Stream6 preprocessor.
Added improved support to block malware in FTP preprocessor.
Added support to differentiate between active and passive FTP connections.
Improvements done in Stream6 preprocessor to avoid having duplicate packets
in the DAQ retry queue.
Resolved an issue where reputation config incorrectly displayed 'blacklist' in
priority field even though 'whitelist' option was configured.
Added support for multiple expected sessions created per packet
Active response now supports MPLS

New additions:
Added support for detecting 'SSH tunneling over HTTP'.
Improvements:
Behavioral change in file processing to block malware files in inline-test mode also.
Improvements to XFF handling in case of pipelined HTTP requests.
Stability improvements for Stream6 preprocessor.
Resolved an issue where min_ttl decoder was dropping packets in alert mode also.
Added improved support to inspect unlimited packets in HTTP.
Resolved an issue where reputation config incorrectly displayed 'blacklist' in priority field even though 'whitelist' option was configured.

New additions:
AppID is no longer experimental.
SMBv2/SMBv3 support for file inspection.
Port override for metadata service in IPS rules.
AppID Lua detector performance profiling.
Perfmon dumps stats at fixed intervals from absolute time.
New preprocessor alert (18:120) to detect SSH tunneling over HTTP
New config option |disable_replace| to disable replace rule option.
New Stream configraution |log_asymmetric_traffic| to control logging to syslog.
New shell script in tools to create simple Lua detetors for AppID.
Improvements:
sfip_t refactored to use struct in6_addr for all ip addresses.
Post-detection callback for preprocessors.
AppID support for multiple server/client detectors evaluting on same flow.
AppID API for DNS packets.
Memory optimizations throughout.
Support sending UDP active responses.
Fix permon tracking of pruned packets.
Improved support for expected sessions.

Added improved support to the Stream preprocessor for asynchronous TCP traffic
Active response no longer sets the FIN flag on the last segment sent

[*] New additions

Added PAF support for SIP based traffic


[*] Improvements

Resolved a backtracking issue where the 'protected_content' rule option was not matching on content following a content rule option that is not matched.

Resolved an issue where snort dropped privilege levels before attempting to delete its PID file created during the higher privilege level

Improved processing of SSLv3 traffic, IPv6 extensions, HTTPS session reassembly and normalization

Performance improvements for file preprocessor

Stability improvements for ftp_telnet preprocessor

New additions:
Support for Cisco FabricPath decoding/encoding
Improvements:
Resolved an issue where the inline normalization preprocessor incorrectly
resized packets when 'preprocessor normalize_tcp: trim' was enabled
Resolved crash in file processing of HTTP continuations

New additions:
Application Identification Preprocessor, when used in conjunction with open app ID detector content, that will identify application protocol, client, server, and web applications (including those using SSL) and include the info in Snort alert data. In addition, a new rule option keyword 'appid' that can be used to constrain Snort rules based on one or more applications that are identified for the connection.
A new protected_content rule option that is used to match against a content that is hashed. It can be used to obscure the full context of the rule from the administrator.
Protocol Aware Flushing (PAF) improvements for SMTP, POP, and IMAP to more accurately process different portions of email messages and file attachments.
Added ability to test normalization behavior without modifying network traffic. When configured using na_policy_mode:inline-test, statistics will be gathered on packet normalizations that would have occurred, allowing less disruptive testing of inline deployments.
The HTTP Inspection preprocessor now has the ability to decompress DEFLATE and LZMA compressed flash content and DEFLATE compressed PDF content from http responses when configured with the new decompress_swf and decompress_pdf options. This enhancement can be used with existing rule options that already match against decompressed equivalents.
Added improved XFF support to HttpInspect. It is now possible to specify custom HTTP headers to use in place of 'X-Fowarded-For'. In situations where traffic may contain multiple XFF-like headers, it is possible to specify which headers hold precedence.
Added support for Heartbleed detection.
Added control socket command to dump packets.
Added an option to suppress configuration information logging to output.
The Stream5 preprocessor functionality is now split between the new Session and Stream preprocessors.
Improvements:
Maximum IP6 extensions decoded is now configurable.
Update active response to allow for responses of 1500+ bytes that span multiple TCP packets.
Check limits of multiple configurations to not exceed a maximum ID of 4095.
Updated the error output of byte_test, byte_jump, byte_extract to including details on offending options for a given rule.
Update build and install scripts to install preprocessor and engine libraries into user specified libdir.
Improved performance of IP Reputation preprocessor.
The control socket will now report success when reloading empty IP Reputation whitelists/blacklists.
All TCP normalizations can now be enabled individually. See README.normalize for details on using the new options. For consistency with other options, the "urp" tcp normalization keyword now enables the normalization instead of disabling it.
Lowered memory demand of Unicode -> ASCII mapping in HttpInspect.
Updated profiler output to remove duplicate results when using multiple configurations.
Improved performance of FTP reassembly.
Improved compatibility with Mac OSX 10.9 (Mavericks), OpenBSD, FreeBSD, and DragonFlyBSD
Stability improvements in Stream6 preprocessor and FTP preprocessor.

New additions:
Application Identification Preprocessor, when used in conjunction with open app ID detector content, that will identify application protocol, client, server, and web applications (including those using SSL) and include the info in Snort alert data. In addition, a new rule option keyword 'appid' that can be used to constrain Snort rules based on one or more applications that are identified for the connection.
A new protected_content rule option that is used to match against a content that is hashed. It can be used to obscure the full context of the rule from the administrator.
Protocol Aware Flushing (PAF) improvements for SMTP, POP, and IMAP to more accurately process different portions of email messages and file attachments.
Added ability to test normalization behavior without modifying network traffic. When configured using na_policy_mode:inline-test, statistics will be gathered on packet normalizations that would have occurred, allowing less disruptive testing of inline deployments.
The HTTP Inspection preprocessor now has the ability to decompress DEFLATE and LZMA compressed flash content and DEFLATE compressed PDF content from http responses when configured with the new decompress_swf and decompress_pdf options. This enhancement can be used with existing rule options that already match against decompressed equivalents.
Added improved XFF support to HttpInspect. It is now possible to specify custom HTTP headers to use in place of 'X-Fowarded-For'. In situations where traffic may contain multiple XFF-like headers, it is possible to specify which headers hold precedence.
Added support for Heartbleed detection.
Added control socket command to dump packets.
Added an option to suppress configuration information logging to output.
The Stream5 preprocessor functionality is now split between the new Session and Stream preprocessors.
Improvements:
Maximum IP6 extensions decoded is now configurable.
Update active response to allow for responses of 1500+ bytes that span multiple TCP packets.
Check limits of multiple configurations to not exceed a maximum ID of 4095.
Updated the error output of byte_test, byte_jump, byte_extract to including details on offending options for a given rule.
Update build and install scripts to install preprocessor and engine libraries into user specified libdir.
Improved performance of IP Reputation preprocessor.
The control socket will now report success when reloading empty IP Reputation whitelists/blacklists.
All TCP normalizations can now be enabled individually. See README.normalize for details on using the new options. For consistency with other options, the "urp" tcp normalization keyword now enables the normalization instead of disabling it.
Lowered memory demand of Unicode -> ASCII mapping in HttpInspect.
Updated profiler output to remove duplicate results when using multiple configurations.
Improved performance of FTP reassembly.
Improved compatibility with Mac OSX 10.9 (Mavericks), OpenBSD, FreeBSD, and DragonFlyBSD
Stability improvements in Stream6 preprocessor and FTP preprocessor.

New additions:
Added the ability to specify additional custom 'x-forwarder-for' http field names
A new http inspection configuration element is used to specify a set of
field names and their respective precedence order
Added cache flow timeout for IP
Improvements:
Fixed handling of ICMPv6 traffic
Fixed inline stream reassembly during file processing
Addressed race condition issue with Perfmon stats file rollover

Improvements:
Added a control command to dump all packets matching a BPF to a pcap file for capturing specific traffic for further analysis
Address issue for encoded packets and icmp header length determination
Provide more detailed error output for parsing of invalid rules when byte_test, byte_check, content, and isdataat use a byte_extract value
Updated sensitive data to better address partial matches between packets

Includes changes from the previous Beta version

New additions:
Add support to do file specific processing within DCERPC preprocessor for files being transferred over SMB.
File capture and storage -- saves files as they traverse the network via a new preprocessor that ties in support within HTTP, FTP, SMTP, POP, IMAP, and SMB. See README.file and README.file_server (under tools/file_server) for details.
Add = operators to byte_test rule option.
Update SMTP to detect Cyrus SASL authentication attack.
Add capability to capture a single session from start to end.
EXPERIMENTAL: Add support to leverage file type identification in snort rules. See README.file_ips for details.
Improvements:
Only inject active responses when a TCP session is established.
Update the POP and IMAP protocols to support simple PAF for improved identification and capture of files.
Update SMTP, POP, IMAP to improve inspection when mime boundaries are split across packets.
Address issue to address end of line incorrectly for Quoted Printable email attachments.
Handle out of order SSL handshake in SMTP when STARTTLS is used and fix checks for SSL type only within the SSL hand shake.
Update sensitive data preprocessor to handle a stateful search of patterns across multiple packets.
Address a few issues in the Snort manual and other READMEs for flowbits and tunneling.
Save off packet data for quicker debugging in case of a SIGABRT or SIGBUS.

src/build.h:
updating build number to 208
src/preprocessors/Stream5/snort_stream5_tcp.c:
add NULL check for preprocessors that check for PAF before they check for any actual tcp session
src/detection-plugins/: sp_byte_check.c, sp_byte_jump.c,
sp_isdataat.c, sp_pattern_match.c:
Test if the byte extracted distance and/or offset is within bounds of the search buffer.
src/preprocessors/HttpInspect/client/hi_client.c:
clear cookie normalization buffer to avoid accidental null dereference in pipelined request.

крутизна этой программы не вне критики......)