Some of you may remember I wrote about impedance mismatch that occurs between security layers. Ryan Barnett made an interesting post to the mod-security-users mailing list the other day:
Those of you running Snort in addition to ModSecurity undoubtedly saw the Snort URI rule bypass bug announced last week - http://www.demarc.com/support/downloads/patch_20060531.
I run both Snort and ModSecurity in my DMZ segment to identify/prevent HTTP attacks. They are a great compliment to each other as they are different tools - 1 a network-based IDS and 1 an embedded WAF within Apache.
Nothing highlights the differences between the 2 and how they handle HTTP data more than this type of vulnerability announcement. Snort is doing the best that it can to interrogate HTTP transactions however the fact is that it is not a web server so there will be mistakes made as it analyzes data. ModSecurity, on the other hand, is integrate into Apache and therefore does not fall victim to this type of HTTP evasion attack.
When this announcement was released, I quickly ran some tests between Snort and ModSecurity to verify that ModSecurity did in fact identify and block my requests with inserted "\r" return characters. Due to the fact that I use the Snort2Modsec.pl script to translate all of the Snort web attack sigs, I had absolutely zero loss of IDS coverage on my web servers while I upgraded/patched Snort :)
He makes an interesting point. It is obvious that running embedded has both positive and negative aspects. Being able to see exactly how web server parses requests is a positive one.