Snort Back Orifice Preprocessor Remote Stack Buffer Overflow Vulnerability
BID:15131
Info
Snort Back Orifice Preprocessor Remote Stack Buffer Overflow Vulnerability
| Bugtraq ID: | 15131 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 18 2005 12:00AM |
| Updated: | Oct 18 2005 12:00AM |
| Credit: | Neel Mehta of the ISS X-Force is credited with the discovery of this issue. |
| Vulnerable: |
Snort Project Snort 2.4.2 Snort Project Snort 2.4.1 Snort Project Snort 2.4 .0 Nortel Networks Threat Protection System Intrusion Sensor 4.1 Nortel Networks Threat Protection System Defense Center 4.1 |
| Not Vulnerable: |
Snort Project Snort 2.4.3 |
Discussion
Snort Back Orifice Preprocessor Remote Stack Buffer Overflow Vulnerability
Snort is susceptible to a remote buffer overflow vulnerability. This issue is due to a failure of the application to securely copy network-derived data into sensitive process buffers. The specific issue exists in the Back Orifice preprocessor.
An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.
Due to the nature of this issue, attackers may exploit it by sending a single UDP packet with a potentially spoofed source address to an arbitrary destination address and port. As long as the application can sniff the packet, it may be exploited. These aspects of this issue may aid attackers in bypassing firewalls in order to compromise a wider number of computers.
Reportedly, this issue is difficult to reliably exploit across differing operating systems and compiler versions. Failed exploit attempts likely result in crashing the application, thereby disabling detection of other attacks.
Snort versions 2.4.0 through 2.4.2 are affected by this issue. Other versions may also be affected, but this has not been confirmed.
Snort is susceptible to a remote buffer overflow vulnerability. This issue is due to a failure of the application to securely copy network-derived data into sensitive process buffers. The specific issue exists in the Back Orifice preprocessor.
An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.
Due to the nature of this issue, attackers may exploit it by sending a single UDP packet with a potentially spoofed source address to an arbitrary destination address and port. As long as the application can sniff the packet, it may be exploited. These aspects of this issue may aid attackers in bypassing firewalls in order to compromise a wider number of computers.
Reportedly, this issue is difficult to reliably exploit across differing operating systems and compiler versions. Failed exploit attempts likely result in crashing the application, thereby disabling detection of other attacks.
Snort versions 2.4.0 through 2.4.2 are affected by this issue. Other versions may also be affected, but this has not been confirmed.
Exploit / POC
Snort Back Orifice Preprocessor Remote Stack Buffer Overflow Vulnerability
A semi-functional proof of concept (snort_bo_ping.pm) has been provided by H D Moore <[email protected]>.
Another proof of concept exploit (THCsnortbo.c) is available from [email protected].
An exploit (snort_bo_overflow_win32.pm) for Windows Snort binaries has been released by Kira. This exploit requires the Metasploit Framework.
An exploit (20051111.snortxp.c) was released by Russell Sanford.
A semi-functional proof of concept (snort_bo_ping.pm) has been provided by H D Moore <[email protected]>.
Another proof of concept exploit (THCsnortbo.c) is available from [email protected].
An exploit (snort_bo_overflow_win32.pm) for Windows Snort binaries has been released by Kira. This exploit requires the Metasploit Framework.
An exploit (20051111.snortxp.c) was released by Russell Sanford.
Solution / Fix
Snort Back Orifice Preprocessor Remote Stack Buffer Overflow Vulnerability
Solution:
Nortel Networks has released Nortel TPS Snort Engine Update (SEU) #6 to address this issue in Threat Protection System Intrusion Sensor/Threat Protection System Defense Center 4.1. Please refer to the attached Nortel Networks advisory for further information.
The vendor has released version 2.4.3 to address this issue:
Snort Project Snort 2.4 .0
Snort Project Snort 2.4.1
Snort Project Snort 2.4.2
Nortel Networks Threat Protection System Intrusion Sensor 4.1
Nortel Networks Threat Protection System Defense Center 4.1
Solution:
Nortel Networks has released Nortel TPS Snort Engine Update (SEU) #6 to address this issue in Threat Protection System Intrusion Sensor/Threat Protection System Defense Center 4.1. Please refer to the attached Nortel Networks advisory for further information.
The vendor has released version 2.4.3 to address this issue:
Snort Project Snort 2.4 .0
-
Snort Project snort-2.4.3.tar.gz
http://www.snort.org/dl/current/snort-2.4.3.tar.gz
Snort Project Snort 2.4.1
-
Snort Project snort-2.4.3.tar.gz
http://www.snort.org/dl/current/snort-2.4.3.tar.gz
Snort Project Snort 2.4.2
-
Snort Project snort-2.4.3.tar.gz
http://www.snort.org/dl/current/snort-2.4.3.tar.gz
Nortel Networks Threat Protection System Intrusion Sensor 4.1
-
Nortel Networks Nortel TPS Snort Engine Update (SEU) #6
http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=SWDET AIL&SoftwareOID=362101
Nortel Networks Threat Protection System Defense Center 4.1
-
Nortel Networks Nortel TPS Snort Engine Update (SEU) #6
http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=SWDET AIL&SoftwareOID=362101
References
Snort Back Orifice Preprocessor Remote Stack Buffer Overflow Vulnerability
References:
References:
- Snort Back Orifice Parsing Remote Code Execution (Internet Security Systems)
- Snort Back Orifice Vulnerability (Snort)
- Snort Homepage (Snort Project)
- Snort News (Snort)
- TA05-291A - Snort Back Orifice Preprocessor Buffer Overflow (US-CERT)
- Threat Protection System - Back Orifice Preprocessor Buffer Overflow (Nortel Networks)
- VU#175500 - Buffer overflow in Snort Back Orifice preprocessor (US-CERT)