Snort contains a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to a flaw in the Remote Procedure Call (RPC) preprocessor. If an attacker sends fragmented RPC traffic to a system running Snort, they may be able to overflow the buffer and crash the IDS or execute arbitrary code with the same privileges as the IDS.
Classification
Location:
Remote / Network Access
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Integrity,
Loss of Availability
Solution:
Workaround,
Upgrade
Exploit:
Exploit Rumored
Disclosure:
OSVDB Verified,
Vendor Verified
OSVDB:
Security Software
Solution
Upgrade to version 2.0 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: disable the rpc_decode preprocessor
edit snort.conf, replace any lines that begin with "preprocessor rpc_decode" with "preprocessor rpc_decode"
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
iss.net -
Internet Security Systems
