OSVDB ID: 32096

Title: Snort Rule Predicate Rule Matching Backtrack DoS

Info

Disclosure
Dec 12, 2006

Discovery
Aug 16, 2006

Dates

Exploit
Unknown

Solution
Unknown

Description

 Snort contains a flaw that may allow a remote denial of service. The issue is triggered when specially crafted network packets cause CPU consumption and detection outage, and will result in loss of availability for the service.

Classification

 Location: Remote / Network Access
Attack Type: Denial of Service
Impact: Loss of Availability
Solution: Upgrade
Exploit: Exploit Unknown
Disclosure: OSVDB Verified, Vendor Verified
OSVDB: Security Software

Solution

 Upgrade to version 2.6.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Sourcefire, Inc.

Snort

 2.6.1
2.6.0.2
2.6.0.1
2.4.5
2.4.4
2.4.3
2.4.2
2.4.0
2.3.3
2.3.2
2.3.1
2.3.0
2.2
2.1.3
2.1.1RC1
2.1.0
2.0.6
2.0.4
2.0
1.9.1
1.9
1.8
1.7
1.6
1.5

References

Credit
  • Randy Smith - University of Wisconsin-Madison
  • Christian Estan - University of Wisconsin-Madison
  • Somesh Jha - University of Wisconsin-Madison


Direct URL: http://osvdb.org/32096