Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Generic)  >   Cisco Snort Vendors:
Snort Buffer Overflow in Back Orifice Preprocessor Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1015070
SecurityTracker URL:
CVE Reference:   CVE-2005-3252   (Links to External Site)
Updated:  Jun 15 2008
Original Entry Date:  Oct 18 2005
Impact:   Execution of arbitrary code via network, Root access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.4.0 to prior to 2.4.3
Description:   A vulnerability was reported in Snort. A remote user can execute arbitrary code on the target system.

The Snort Back Orifice preprocessor contains a buffer overflow. A remote user can send a single specially crafted UDP packet to overflow the stack and execute arbitrary code on the target system. The code will run with the privileges of the Snort process, which may be root or administrative privileges on some systems. The packet must be sent to or via a network that is monitored by Snort.

Only systems with the Back Orifice preprocessor enabled are affected.

ISS X-Force discovered this vulnerability.

Impact:   A remote user can execute arbitrary code on the target system, typically with root level privileges.
Solution:   The vendor has issued a fixed version (2.4.0), available at:

Nortel's Threat Protection System version 4.1 is vulnerable because it includes the affected Snort engine. Users should apply SEU#6:

Vendor URL: (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.

 Source Message Contents

[Original Message Not Available for Viewing]

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, LLC