Vulnerability Note VU#175500

Snort Back Orifice preprocessor buffer overflow

Original Release date: 18 Oct 2005 | Last revised: 11 Nov 2005

Overview

A buffer overflow exists in the Snort Back Orifice preprocessor that may allow a remote, unauthenticated attacker to execute arbitrary code, possibly with elevated privileges.

Description

Snort is an open-source intrusion detection system (IDS). A lack of validation on attacker-controlled data may allow a buffer overflow to occur in the in Snort Back Orifice preprocessor. A remote, unauthenticated attacker may be able to trigger the buffer overflow by sending a specially crafted Back Orifice ping to a vulnerable Snort installation.

To exploit this vulnerability, an attacker does not need to send packets directly to the Snort sensor. It is sufficient to send packets to any of the hosts on the network monitored by Snort.

Impact

A remote attacker can execute arbitrary code with the privileges of the Snort process, typically root or SYSTEM.

Solution


Update

This issue has been addressed in Snort version 2.4.3.


Disable Snort Back Orifice preprocessor

Disabling the Snort Back Orifice preprocessor will mitigate this vulnerability. However, without the Snort preprocessor, the Snort sensor will not detect or prevent Back Orifice traffic. Snort suggests the following steps to disable the Back Orifice preprocessor:

    The Back Orifice preprocessor can be disabled by commenting out the line "preprocessor bo" in snort.conf. This can be done in any text editor using the following procedure:

    1. Locate the line "preprocessor bo"
    2. Comment out this line by preceding it with a hash (#). The new line will look like "#preprocessor bo"
    3. Save the file
    4. Restart snort

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
FreeBSD, Inc.Affected18 Oct 200518 Oct 2005
Nortel Networks, Inc.Affected18 Oct 200519 Oct 2005
SnortAffected14 Oct 200518 Oct 2005
SourcefireAffected14 Oct 200526 Oct 2005
SUSE LinuxAffected18 Oct 200519 Oct 2005
UbuntuAffected18 Oct 200519 Oct 2005
Apple Computer, Inc.Not Affected18 Oct 200509 Nov 2005
Avaya, Inc.Not Affected18 Oct 200518 Oct 2005
Debian LinuxNot Affected18 Oct 200511 Nov 2005
F5 Networks, Inc.Not Affected18 Oct 200519 Oct 2005
Global Technology AssociatesNot Affected18 Oct 200518 Oct 2005
HitachiNot Affected18 Oct 200520 Oct 2005
Internet Security Systems, Inc.Not Affected14 Oct 200518 Oct 2005
IntotoNot Affected18 Oct 200511 Nov 2005
Juniper Networks, Inc.Not Affected18 Oct 200520 Oct 2005
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This vulnerability was researched and reported by Internet Security Systems (ISS).

This document was written by Art Manion and Jeff Gennari.

Other Information

  • CVE IDs: CAN-2005-3252
  • Date Public: 18 Oct 2005
  • Date First Published: 18 Oct 2005
  • Date Last Updated: 11 Nov 2005
  • Severity Metric: 31.05
  • Document Revision: 37

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.