[ISN] Sourcefire discloses buffer-overflow vulnerability in Snort

[InfoSec News]

http://www.networkworld.com/news/2005/101805-snort.html

By Ellen Messmer
NetworkWorld.com
10/18/05

Sourcefire, which oversees the open-source intrusion-detection system 
Snort and makes commercial products based on it, Tuesday disclosed a 
major vulnerability in Snort along with corrective measures to 
mitigate the risk. 

Snort versions 2.4.0 and higher are subject to a buffer-overflow 
vulnerability that would let an attacker execute code remotely on a 
Snort sensor when the Back Orifice preprocessor is running, resulting 
in complete compromise of Snort. The Back Orifice preprocessor is the 
Snort functionality for detecting any activity associated with the 
malicious back-door code Back Orifice. 

Jennifer Steffens, Sourcefire's director of product management, said 
there are two ways Sourcefire is advising Snort users and Sourcefire 
customers to eliminate the problem. Details about the vulnerability 
and mitigation instructions from Sourcefire are here [1].  

Sourcefire is urging users to install an updated version of Snort 
released Tuesday, Snort v. 2.4.3, to correct the problem. If it's not 
feasible for Snort users or Sourcefire customers to immediately update 
the new version that corrects the buffer-overflow vulnerability, then 
they should consider disabling the Back Orifice preprocessor function. 
"But then they wouldn't be able to detect Back Orifice activity," 
Steffens added. 

The flaw associated with Snort's Back Orifice preprocessor is only the 
second major vulnerability to be discovered in Snort for the past two 
years, she added. 

The Snort vulnerability was first uncovered by Internet Security 
Systems (ISS), which reported it directly to US-CERT, which 
transmitted the information to Sourcefire. Snort information from 
US-CERT can be found here [2]. 

Steffens said Sourcefire heard about it on Oct. 13 and spent the 
weekend testing for it and coming up with a fix. There are an 
undisclosed number of Sourcefire customers and about 100,000 users of 
open-source Snort. 

Neel Mehta, team lead at the ISS X-Force research and development 
division, which investigates security weaknesses throughout a wide 
variety of vendor products, said ISS discovered the Snort 
vulnerability while doing routine testing. 

"It's trivial to exploit," Mehta claims. "Anyone who does 
vulnerability testing can do this. It's a buffer overflow that is 
triggered with a single UDP packet. It would make it easy for worms to 
exploit this."

Mehta said ISS took its concerns directly to US-CERT, the group 
responsible for alerting government agencies and the public,  "asking 
them to do the coordination on this since there are a wide number of 
Snort users."

"We saw it as an infrastructure issue," says Mehta.

[1] http://www.snort.org/rules/advisories/snort_update_20051018.html
[2] http://www.kb.cert.org/vuls/id/MIMG-6H6P65