Snort ICMP Denial of Service Vulnerability
BID:3849
Info
Snort ICMP Denial of Service Vulnerability
| Bugtraq ID: | 3849 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 10 2002 12:00AM |
| Updated: | Jan 10 2002 12:00AM |
| Credit: | Discovered by "Sinbad" <[email protected]> and posted to the BugTraq mailing list on January 10, 2002. |
| Vulnerable: |
Snort Project Snort 1.8.3 |
| Not Vulnerable: | |
Discussion
Snort ICMP Denial of Service Vulnerability
Snort is a network intrusion detection system (IDS). It is originally written for Linux and Unix systems, although it has also been ported to run under Microsoft Windows. Snort is capable of flexible and powerful content analysis of network traffic, and can detect a large number of attack attempts.
An error exists in some versions of Snort. If a maliciously constructed ICMP packet is received, the daemon will crash. This is caused because Snort erroneously defines the minimum ICMP header size as 8 bytes. A restart will be required to regain normally functionality.
Snort is a network intrusion detection system (IDS). It is originally written for Linux and Unix systems, although it has also been ported to run under Microsoft Windows. Snort is capable of flexible and powerful content analysis of network traffic, and can detect a large number of attack attempts.
An error exists in some versions of Snort. If a maliciously constructed ICMP packet is received, the daemon will crash. This is caused because Snort erroneously defines the minimum ICMP header size as 8 bytes. A restart will be required to regain normally functionality.
Exploit / POC
Snort ICMP Denial of Service Vulnerability
The following command is sufficient to exploit this vulnerability, and has been provided by KF <[email protected]>:
ping -c1 -s1 host
The following command is sufficient to exploit this vulnerability, and has been provided by KF <[email protected]>:
ping -c1 -s1 host
Solution / Fix
Snort ICMP Denial of Service Vulnerability
Solution:
The following patch has been suggested by Martin Roesch <[email protected]>, and is included in the 1.8 Snort codebase in build 90.
Snort Project Snort 1.8.3
Solution:
The following patch has been suggested by Martin Roesch <[email protected]>, and is included in the 1.8 Snort codebase in build 90.
Snort Project Snort 1.8.3
-
Martin Roesch
http://www.securityfocus.com/data/vulnerabilities/patches/snort-icmp.p atch