Sourcefire Intrusion Sensor Buffer Overflow in DCE/RPC Preprocessor Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID: 1017670|
SecurityTracker URL: http://securitytracker.com/id/1017670
(Links to External Site)
Date: Feb 20 2007
Execution of arbitrary code via network, User access via network|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): 4.1.x, 4.5.x, and 4.6x; all prior to SEU64|
A vulnerability was reported in Sourcefire's Intrusion Sensors. A remote user can execute arbitrary code on the target system.|
A remote user can send specially crafted data to trigger a stack overflow and execute arbitrary code on the target system. The code will run with the privileges of the target Snort service.
The Sourcefire Intrusion Sensors version 4.1.x, 4.5.x, and 4.6x with SEUs prior to SEU 64 are affected. The Sourcefire Intrusion Sensors for Crossbeam version 4.1.x, 4.5.x, and 4.6x with SEUs prior to SEU 64 are also affected.
The open source Snort software is also affected.
The vendor credits Neel Mehta from IBM X-with reporting this vulnerability.
A remote user can execute arbitrary code on the target system.|
The vendor has apparently issued a fix and provided information via the Sourcefire support site.|
The Snort advisory is available at:
Vendor URL: www.sourcefire.com/ (Links to External Site)
Source Message Contents
Subject: US-CERT Technical Cyber Security Alert TA07-050A -- Sourcefire Snort|
-----BEGIN PGP SIGNED MESSAGE-----
National Cyber Alert System
Technical Cyber Security Alert TA07-050A
Sourcefire Snort DCE/RPC Preprocessor Buffer Overflow
Original release date: February 19, 2007
Last revised: --
* Snort 2.6.1, 126.96.36.199, and 188.8.131.52
* Snort 2.7.0 beta 1
* Sourcefire Intrusion Sensors version 4.1.x, 4.5.x, and 4.6x with
SEUs prior to SEU 64
* Sourcefire Intrusion Sensors for Crossbeam version 4.1.x, 4.5.x,
and 4.6x with SEUs prior to SEU 64
Other products that use Snort or Snort components may be affected.
A stack buffer overflow vulnerability in the Sourcefire Snort
DCE/RPC preprocessor could allow an unauthenticated, remote
attacker to execute arbitrary code with the privileges of the Snort
Sourcefire Snort is a widely-deployed, open-source network
intrusion detection system (IDS). Snort and its components are used
in other IDS products, notably Sourcefire, and Snort is included
with a number of operating system distributions. The DCE/RPC
preprocessor reassembles fragmented SMB and DCE/RPC traffic before
passing data to the Snort rules.
The vulnerable code does not properly reassemble certain types of
SMB and DCE/RPC packets. An attacker could exploit this
vulnerability by sending a specially crafted TCP packet to a host
or network monitored by Snort. The DCE/RPC preprocessor is enabled
by default, and it is not necessary for an attacker to complete a
US-CERT is tracking this vulnerability as VU#196240. This
vulnerability has been assigned CVE number CVE-2006-5276. Further
information is available in advisories from Sourcefire and ISS.
A remote, unauthenticated attacker may be able to execute arbitrary
code with the privilege level of the Snort preprocessor.
Snort 184.108.40.206 is available from the Snort download site. Sourcefire
customers should visit the Sourcefire Support Login site.
Disable the DCE/RPC Preprocessor
To disable the DCE/RPC preprocessor, comment out the line that loads
the preprocessor in the Snort configuration file (typically
/etc/snort.conf on UNIX and Linux systems):
Restart Snort for the change to take effect.
Disabling the preprocessor will prevent Snort from reassembling
fragmented SMB and DCE/RPC packets. This may allow attacks to evade
* US-CERT Vulnerability Note VU#196240 -
* Sourcefire Advisory 2007-02-19 -
* Sourcefire Support Login - <https://support.sourcefire.com/>
* Sourcefire Snort Release Notes for 220.127.116.11 -
* Snort downloads - <http://www.snort.org/dl/>
* DCE/RPC Preprocessor -
* IBM Internet Security Systems Protection Advisory -
* CVE-2006-5276 -
The most recent version of this document can be found at:
Feedback can be directed to US-CERT Technical Staff. Please send
email to <email@example.com> with "TA07-050A Feedback VU#196240" in the
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
Produced 2007 by US-CERT, a government organization.
February 19, 2007: Initial Release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
-----END PGP SIGNATURE-----