The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Snort Back Orifice Preprocessor Buffer Overflow Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.snort.org/> Snort is a widely-deployed, open-source network
intrusion detection system (IDS). Snort preprocessors are modular plugins
that extend functionality by operating on packets before the detection
engine is run.
The Snort Back Orifice preprocessor contains a buffer overflow that could
allow a remote attacker to execute arbitrary code on a vulnerable system.
DETAILS
Vulnerable Systems:
* Snort versions 2.4.0 to 2.4.2
* Sourcefire Intrusion Sensors
The Back Orifice preprocessor decodes packets to determine if they contain
Back Orifice ping messages. The ping detection code does not adequately
limit the amount of data that is read from the packet into a fixed-length
buffer, thus creating the potential for a buffer overflow.
The vulnerable code will process any UDP packet that is not destined to or
sourced from the default Back Orifice port (31337/udp). An attacker could
exploit this vulnerability by sending a specially crafted UDP packet to a
host or network monitored by Snort.
The Snort Back Orifice preprocessor vulnerability can be triggered with a
single UDP packet targeting virtually any port. As such, there is a large
potential that these packets can bypass perimeter firewall defenses. An
attack need not be directly targeted at a Snort installation, but merely
towards a network monitored by Snort. Due to the trivial nature of this
vulnerability and its potential to bypass perimeter firewalls, there is
grave concern that this issue might be exploited as part of a
network-based worm.
A remote attacker who can send UDP packets to a Snort sensor may be able
to execute arbitrary code. Snort typically runs with root or SYSTEM
privileges, so an attacker could take complete control of a vulnerable
system. An attacker does not need to target a Snort sensor directly; the
attacker can target any host or network monitored by Snort.
US-CERT is tracking this vulnerability as
<http://www.kb.cert.org/vuls/id/175500> VU#175500. Further information is
available in an <http://xforce.iss.net/xforce/alerts/id/207> advisory
from Internet Security Systems (ISS).
ADDITIONAL INFORMATION
The original article can be found at:
<http://www.us-cert.gov/cas/techalerts/TA05-291A.html>
http://www.us-cert.gov/cas/techalerts/TA05-291A.html
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
