Vulnerability record · CVE-2004-2652 · published 31 December 2004

CVE-2004-2652: Sourcefire snort vulnerability

SSourcefire · Snort

The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remote attackers to cause a denial of service (crash) via packets with invalid TCP/IP options, which trigger a null dereference.

7.8 CVSS 2.0 High EPSS 11% · top 4.2%

7.8CVSS 2.0 base score

11%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

18References, 10 tagged exploit

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

SSnort Sourcefire

References

Link	Tags
http://secunia.com/advisories/13664	PatchVendor Advisory
http://securitytracker.com/id?1012656	ExploitPatch
http://taosecurity.blogspot.com/2004/12/details-on-snort-dos-condition-you-may.html	ExploitVendor Advisory
http://www.frsirt.com/exploits/20041222.angelDust.c.php
http://www.osvdb.org/12578	Exploit
http://www.securiteam.com/exploits/6X00L20C0S.html	Exploit
http://www.securityfocus.com/bid/12084	Exploit
http://www.snort.org/arc_news/
https://exchange.xforce.ibmcloud.com/vulnerabilities/18689
http://secunia.com/advisories/13664	PatchVendor Advisory
http://securitytracker.com/id?1012656	ExploitPatch
http://taosecurity.blogspot.com/2004/12/details-on-snort-dos-condition-you-may.html	ExploitVendor Advisory
http://www.frsirt.com/exploits/20041222.angelDust.c.php
http://www.osvdb.org/12578	Exploit
http://www.securiteam.com/exploits/6X00L20C0S.html	Exploit
http://www.securityfocus.com/bid/12084	Exploit
http://www.snort.org/arc_news/
https://exchange.xforce.ibmcloud.com/vulnerabilities/18689

Track CVE-2004-2652 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2003-0209Smoothwall vulnerabilityInteger overflow in the TCP stream reassembly module (stream4) for Snort 2.0 and earlier allows remote attackers to execute arbitrary code via large …EPSS 39%5 May 2003 7.5CVE-2005-3252Snort Back Orifice preprocessor stack buffer overflow via crafted UDP packetSnort before 2.4.3 contains a stack-based buffer overflow in its Back Orifice (BO) preprocessor. A crafted UDP packet triggers the overflow, allowing…EPSS 84%analysed18 Oct 2005 5.0CVE-2006-2769Sourcefire snort permissions and access controls vulnerabilityThe HTTP Inspect preprocessor (http_inspect) in Snort 2.4.0 through 2.4.4 allows remote attackers to bypass "uricontent" rules via a carriage return …EPSS 11%2 Jun 2006 5.0CVE-2006-0839Sourcefire snort vulnerabilityThe frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attacke…EPSS 1.4%22 Feb 2006

Source: NIST National Vulnerability Database (record CVE-2004-2652), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.