what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Technical Cyber Security Alert 2007-50A

Technical Cyber Security Alert 2007-50A
Posted Feb 23, 2007
Authored by US-CERT | Site us-cert.gov

Technical Cyber Security Alert TA07-050A - A stack buffer overflow vulnerability in the Sourcefire Snort DCE/RPC preprocessor could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Snort process.

tags | advisory, remote, overflow, arbitrary
advisories | CVE-2006-5276
SHA-256 | e32bdc2aaf40eca3df98337e15f1c09bacbaac00e0059399fcd3bad10dcab52a

Technical Cyber Security Alert 2007-50A

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


National Cyber Alert System

Technical Cyber Security Alert TA07-050A


Sourcefire Snort DCE/RPC Preprocessor Buffer Overflow

Original release date: February 19, 2007
Last revised: --
Source: US-CERT


Systems Affected

* Snort 2.6.1, 2.6.1.1, and 2.6.1.2
* Snort 2.7.0 beta 1
* Sourcefire Intrusion Sensors version 4.1.x, 4.5.x, and 4.6x with
SEUs prior to SEU 64
* Sourcefire Intrusion Sensors for Crossbeam version 4.1.x, 4.5.x,
and 4.6x with SEUs prior to SEU 64

Other products that use Snort or Snort components may be affected.


Overview

A stack buffer overflow vulnerability in the Sourcefire Snort
DCE/RPC preprocessor could allow an unauthenticated, remote
attacker to execute arbitrary code with the privileges of the Snort
process.


I. Description

Sourcefire Snort is a widely-deployed, open-source network
intrusion detection system (IDS). Snort and its components are used
in other IDS products, notably Sourcefire, and Snort is included
with a number of operating system distributions. The DCE/RPC
preprocessor reassembles fragmented SMB and DCE/RPC traffic before
passing data to the Snort rules.

The vulnerable code does not properly reassemble certain types of
SMB and DCE/RPC packets. An attacker could exploit this
vulnerability by sending a specially crafted TCP packet to a host
or network monitored by Snort. The DCE/RPC preprocessor is enabled
by default, and it is not necessary for an attacker to complete a
TCP handshake.

US-CERT is tracking this vulnerability as VU#196240. This
vulnerability has been assigned CVE number CVE-2006-5276. Further
information is available in advisories from Sourcefire and ISS.


II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary
code with the privilege level of the Snort preprocessor.


III. Solution

Upgrade

Snort 2.6.1.3 is available from the Snort download site. Sourcefire
customers should visit the Sourcefire Support Login site.

Disable the DCE/RPC Preprocessor

To disable the DCE/RPC preprocessor, comment out the line that loads
the preprocessor in the Snort configuration file (typically
/etc/snort.conf on UNIX and Linux systems):

[/etc/snort.conf]
...
#preprocessor dcerpc...
...

Restart Snort for the change to take effect.

Disabling the preprocessor will prevent Snort from reassembling
fragmented SMB and DCE/RPC packets. This may allow attacks to evade
the IDS.


IV. References

* US-CERT Vulnerability Note VU#196240 -
<http://www.kb.cert.org/vuls/id/196240>

* Sourcefire Advisory 2007-02-19 -
<http://www.snort.org/docs/advisory-2007-02-19.html>

* Sourcefire Support Login - <https://support.sourcefire.com/>

* Sourcefire Snort Release Notes for 2.6.1.3 -
<http://www.snort.org/docs/release_notes/release_notes_2613.txt>

* Snort downloads - <http://www.snort.org/dl/>

* DCE/RPC Preprocessor -
<http://www.snort.org/docs/snort_htmanuals/htmanual_261/node104.html>

* IBM Internet Security Systems Protection Advisory -
<http://iss.net/threats/257.html>

* CVE-2006-5276 -
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-5276>


____________________________________________________________________

The most recent version of this document can be found at:

<http://www.us-cert.gov/cas/techalerts/TA07-050A.html>
____________________________________________________________________

Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "TA07-050A Feedback VU#196240" in the
subject.
____________________________________________________________________

For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________

Produced 2007 by US-CERT, a government organization.

Terms of use:

<http://www.us-cert.gov/legal.html>
____________________________________________________________________


Revision History

February 19, 2007: Initial Release

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRdop4+xOF3G+ig+rAQKdtAgAhQY66LRfVlNkH30Q5RI0gIo5Vhu14yDP
qulLEyzjDhC7gDHWBGQYdE9eCy9Yf3P4BfKJS0766he/7CFn+BaDs7ohnXaynHQq
+kMYNBMBg2RbrGKfOGRLHc0P6X1tSP3w45IppjOv9Yo5SUVDCa7beZWURCIKZyp6
OuYXtnpiGNctHgeU56US0sfuKj8qP7KOd9pCDRDQRhJ3UUd9wDpXee66HBxchh+w
RSIQiMxisOX9mMYBW3z4DM/lb7PxXoa2Q7DwjM1NIOe/0tAObCOvF4uYhOLCVyNg
+EbcN9123V0PW95FITlHXvJU6K8srnnK+Fhpfyi4vg5bYeEF2WiUrg==
=T7v8
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    0 Files
  • 7
    Mar 7th
    0 Files
  • 8
    Mar 8th
    0 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    0 Files
  • 14
    Mar 14th
    0 Files
  • 15
    Mar 15th
    0 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close