what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

snort-preprocessor.txt

snort-preprocessor.txt
Posted Feb 20, 2007
Site snort.org

Sourcefire has learned of a remotely exploitable vulnerability in the Snort DCE/RPC preprocessor. This preprocessor is vulnerable to a stack-based buffer overflow that could potentially allow attackers to execute code with the same privileges as the Snort binary. Sourcefire has prepared updates for Snort open-source software to address this issue. Snort Versions affected include Snort 2.6.1, 2.6.1.1, and 2.6.1.2 and Snort 2.7.0 beta 1.

tags | advisory, overflow
advisories | CVE-2006-5276
SHA-256 | fef4c3ca73f6930bc8ba37134b82478ff1597215d11e0f89b9720b92fc811722

snort-preprocessor.txt

Change Mirror Download
February 19, 2007

Summary:

Sourcefire has learned of a remotely exploitable vulnerability in the
Snort DCE/RPC preprocessor. This preprocessor is vulnerable to a
stack-based buffer overflow that could potentially allow attackers to
execute code with the same privileges as the Snort binary. Sourcefire
has prepared updates for Snort open-source software to address this issue.

This vulnerability has been identified as CVE-2006-5276.


Snort Versions Affected:

* Snort 2.6.1, 2.6.1.1, and 2.6.1.2
* Snort 2.7.0 beta 1

This vulnerability also affects Sourcefire commercial products. For
information and updates for Sourcefire products, please go to the
Sourcefire support site.


Mitigating Factors:

Users who have disabled the DCE/RPC preprocessor are not vulnerable.
However, the DCE/RPC preprocessor is enabled by default.


Recommended Actions:

* Open-source Snort 2.6.1.x users are advised to upgrade to Snort
2.6.1.3 (or later) immediately.
* Open-source Snort 2.7 beta users are advised to mitigate this issue by
disabling the DCE/RPC preprocessor.
This issue will be resolved in Snort 2.7 beta 2.


Workarounds:

Snort users who cannot upgrade immediately are advised to disable the
DCE/RPC preprocessor by removing the DCE/RPC preprocessor directives
from snort.conf and restarting Snort. However, be advised that disabling
the DCE/RPC preprocessor reduces detection capabilities for attacks in
DCE/RPC traffic. After upgrading, customers should reenable the DCE/RPC
preprocessor.


Detecting Attacks Against This Vulnerability:

Sourcefire will be releasing a rule pack that provides detection for
attacks against this vulnerability.


FAQs:

What does the update do?
- Snort 2.6.1.3 (or later) removes the vulnerability by correcting the
buffer overflow condition in the DCE/RPC preprocessor.

Has Sourcefire received any reports that this vulnerability has been
exploited?
- No. Sourcefire has not received any reports that this vulnerability
has been exploited.


Acknowledgments:

Sourcefire would like to thank Neel Mehta from IBM X-Force for reporting
this issue and working with us to resolve it.


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    20 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close