Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire Intrusion Sensor; allows remote attackers to execute arbitrary code via crafted SMB traffic.

This build moves from manual linking to alternatives.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200703-01 (Snort: Remote execution of arbitrary code)

    The Snort DCE/RPC preprocessor does not properly reassemble certain     types of fragmented SMB and DCE/RPC packets.
  Impact :

    A remote attacker could send specially crafted fragmented SMB or     DCE/RPC packets, without the need to finish the TCP handshake, that     would trigger a stack-based buffer overflow while being reassembled.
    This could lead to the execution of arbitrary code with the permissions     of the user running the Snort preprocessor.
  Workaround :

    Disable the DCE/RPC processor by commenting the 'preprocessor dcerpc'     section in /etc/snort/snort.conf .

A IBM Internet Security Systems Protection Advisory reports :

Snort is vulnerable to a stack-based buffer overflow as a result of DCE/RPC reassembly. This vulnerability is in a dynamic-preprocessor enabled in the default configuration, and the configuration for this preprocessor allows for auto-recognition of SMB traffic to perform reassembly on. No checks are performed to see if the traffic is part of a valid TCP session, and multiple Write AndX requests can be chained in the same TCP segment. As a result, an attacker can exploit this overflow with a single TCP PDU sent across a network monitored by Snort or Sourcefire.

Snort users who cannot upgrade immediately are advised to disable the DCE/RPC preprocessor by removing the DCE/RPC preprocessor directives from snort.conf and restarting Snort. However, be advised that disabling the DCE/RPC preprocessor reduces detection capabilities for attacks in DCE/RPC traffic. After upgrading, customers should re-enable the DCE/RPC preprocessor.

ID	Name	Product	Family	Severity
27749	Fedora 7 : snort-2.7.0.1-3.fc7 (2007-2060)	Nessus	Fedora Local Security Checks	critical
24749	GLSA-200703-01 : Snort: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
24686	FreeBSD : snort -- DCE/RPC preprocessor vulnerability (afdf500f-c1f6-11db-95c5-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2006-5276

critical

Tenable Plugins

critical

critical

critical