Snort/Sourcefire DCE/RPC Packet Reassembly Stack Buffer Overflow Vulnerability
BID:22616
Info
Snort/Sourcefire DCE/RPC Packet Reassembly Stack Buffer Overflow Vulnerability
| Bugtraq ID: | 22616 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2006-5276 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 19 2007 12:00AM |
| Updated: | Nov 15 2007 12:38AM |
| Credit: | Neel Mehta of the IBM Internet Security Systems X-Force discovered this vulnerability. |
| Vulnerable: |
Snort Project Snort 2.6.1 .2 Snort Project Snort 2.6.1 .1 Snort Project Snort 2.6.1 Snort Project Snort 2.7.0 beta 1 S.u.S.E. openSUSE 10.1 Redhat Fedora Core7 Redhat Enterprise Linux AS 4 Nortel Networks Threat Protection System Intrusion Sensor 4.1 Nortel Networks Threat Protection System Intrusion Sensor 4.6 Nortel Networks Threat Protection System Intrusion Sensor 4.5 Nortel Networks Threat Protection System Defense Center 4.1 Nortel Networks Threat Protection System Defense Center 4.6 Nortel Networks Threat Protection System Defense Center 4.5 Gentoo net-analyzer/snort 2.6.1 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 |
| Not Vulnerable: |
Snort Project Snort 2.6.1.3 Gentoo net-analyzer/snort 2.6.1.3 |
Discussion
Snort/Sourcefire DCE/RPC Packet Reassembly Stack Buffer Overflow Vulnerability
Snort IDS and Sourcefire Intrusion Sensor are prone to a stack-based buffer-overflow vulnerability because the network intrusion detection (NID) systems fail to handle specially crafted 'DCE' and 'RPC' network packets.
An attacker can exploit this issue to execute malicious code in the context of the user running the affected application. Failed attempts will likely cause these applications to crash.
Snort IDS and Sourcefire Intrusion Sensor are prone to a stack-based buffer-overflow vulnerability because the network intrusion detection (NID) systems fail to handle specially crafted 'DCE' and 'RPC' network packets.
An attacker can exploit this issue to execute malicious code in the context of the user running the affected application. Failed attempts will likely cause these applications to crash.
Exploit / POC
Snort/Sourcefire DCE/RPC Packet Reassembly Stack Buffer Overflow Vulnerability
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
An exploit is available to members of the Immunity Partner's program:
https://www.immunityinc.com/downloads/immpartners/snortrpc.tar
The following exploit code is also available:
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
An exploit is available to members of the Immunity Partner's program:
https://www.immunityinc.com/downloads/immpartners/snortrpc.tar
The following exploit code is also available:
Solution / Fix
Snort/Sourcefire DCE/RPC Packet Reassembly Stack Buffer Overflow Vulnerability
Solution:
Snort IDS/IPS 2.6.1.3 contains a fix to address this issue; please see the references for details.
Snort Project Snort 2.6.1 .2
Snort Project Snort 2.6.1 .1
Snort Project Snort 2.6.1
Solution:
Snort IDS/IPS 2.6.1.3 contains a fix to address this issue; please see the references for details.
Snort Project Snort 2.6.1 .2
-
Snort Project snort-2.6.1.3.tar.gz
http://www.snort.org/dl/current/snort-2.6.1.3.tar.gz
Snort Project Snort 2.6.1 .1
-
Snort Project snort-2.6.1.3.tar.gz
http://www.snort.org/dl/current/snort-2.6.1.3.tar.gz
Snort Project Snort 2.6.1
-
Snort Project snort-2.6.1.3.tar.gz
http://www.snort.org/dl/current/snort-2.6.1.3.tar.gz
References
Snort/Sourcefire DCE/RPC Packet Reassembly Stack Buffer Overflow Vulnerability
References:
References:
- IBM X-Force: Sourcefire Snort Remote Buffer Overflow (IT-ISAC)
- 2007-02-19 Sourcefire Advisory: Vulnerability in Snort DCE/RPC Preprocessor (Snort)
- Snort Homepage (Snort Project)
- [ BULLETIN ] Security vulnerability in TPS DCE/RPC preprocessor (CVE-2006-5276) (Nortel Networks)
- Vulnerability Note VU#196240 - Vulnerability Note VU#196240 (US-CERT)