OSVDB ID: 4418

Title: Snort RPC Decode Module Overflow

Info

Disclosure
Mar 03, 2003

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 Snort contains a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to a flaw in the Remote Procedure Call (RPC) preprocessor. If an attacker sends fragmented RPC traffic to a system running Snort, they may be able to overflow the buffer and crash the IDS or execute arbitrary code with the same privileges as the IDS.

Classification

 Location: Remote / Network Access
Attack Type: Denial of Service, Input Manipulation
Impact: Loss of Integrity, Loss of Availability
Solution: Workaround, Upgrade
Exploit: Exploit Rumored
Disclosure: OSVDB Verified, Vendor Verified
OSVDB: Security Software

Solution

 Upgrade to version 2.0 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: disable the rpc_decode preprocessor edit snort.conf, replace any lines that begin with "preprocessor rpc_decode" with "preprocessor rpc_decode"

Products

Sourcefire, Inc.

Snort

 1.8.x
1.9.0
2.0beta

References

Credit
  • ISS X-Force Research - xforceiss.net - Internet Security Systems


Direct URL: http://osvdb.org/4418