Snort Buffer Overflow in Back Orifice Preprocessor Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1015070
|
|
SecurityTracker URL: http://securitytracker.com/id?1015070
|
|
CVE Reference: CVE-2005-3252
(Links to External Site)
|
Updated: Jun 15 2008
|
Original Entry Date: Oct 18 2005
|
Impact: Execution of arbitrary code via network, Root access via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Internet Security Systems (X-Force)
|
Version(s): 2.4.0 to prior to 2.4.3
|
Description: A vulnerability was reported in Snort. A remote user can execute arbitrary code on the target system.
The Snort Back Orifice preprocessor contains a buffer overflow. A remote user can send a single specially crafted UDP packet to
overflow the stack and execute arbitrary code on the target system. The code will run with the privileges of the Snort process,
which may be root or administrative privileges on some systems. The packet must be sent to or via a network that is monitored by
Snort.
Only systems with the Back Orifice preprocessor enabled are affected.
ISS X-Force discovered this vulnerability.
|
Impact: A remote user can execute arbitrary code on the target system, typically with root level privileges.
|
Solution: The vendor has issued a fixed version (2.4.0), available at:
http://www.snort.org/dl/
Nortel's Threat Protection System version
4.1 is vulnerable because it includes the affected Snort engine. Users should apply SEU#6:
http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=DOCDETAIL&
DocumentOID=362187.000000
|
Vendor URL: www.snort.org/pub-bin/snortnews.cgi#99 (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: X-Force <xforce@iss.net>
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
