By Ellen Messmer
Sourcefire, which oversees the open-source intrusion-detection system
Snort and makes commercial products based on it, Tuesday disclosed a
major vulnerability in Snort along with corrective measures to
mitigate the risk.
Snort versions 2.4.0 and higher are subject to a buffer-overflow
vulnerability that would let an attacker execute code remotely on a
Snort sensor when the Back Orifice preprocessor is running, resulting
in complete compromise of Snort. The Back Orifice preprocessor is the
Snort functionality for detecting any activity associated with the
malicious back-door code Back Orifice.
Jennifer Steffens, Sourcefire's director of product management, said
there are two ways Sourcefire is advising Snort users and Sourcefire
customers to eliminate the problem. Details about the vulnerability
and mitigation instructions from Sourcefire are here .
Sourcefire is urging users to install an updated version of Snort
released Tuesday, Snort v. 2.4.3, to correct the problem. If it's not
feasible for Snort users or Sourcefire customers to immediately update
the new version that corrects the buffer-overflow vulnerability, then
they should consider disabling the Back Orifice preprocessor function.
"But then they wouldn't be able to detect Back Orifice activity,"
The flaw associated with Snort's Back Orifice preprocessor is only the
second major vulnerability to be discovered in Snort for the past two
years, she added.
The Snort vulnerability was first uncovered by Internet Security
Systems (ISS), which reported it directly to US-CERT, which
transmitted the information to Sourcefire. Snort information from
US-CERT can be found here .
Steffens said Sourcefire heard about it on Oct. 13 and spent the
weekend testing for it and coming up with a fix. There are an
undisclosed number of Sourcefire customers and about 100,000 users of
Neel Mehta, team lead at the ISS X-Force research and development
division, which investigates security weaknesses throughout a wide
variety of vendor products, said ISS discovered the Snort
vulnerability while doing routine testing.
"It's trivial to exploit," Mehta claims. "Anyone who does
vulnerability testing can do this. It's a buffer overflow that is
triggered with a single UDP packet. It would make it easy for worms to
Mehta said ISS took its concerns directly to US-CERT, the group
responsible for alerting government agencies and the public, "asking
them to do the coordination on this since there are a wide number of
"We saw it as an infrastructure issue," says Mehta.
InfoSec News v2.0 - Coming Soon!