[UNIX] Snort Back Orifice Preprocessor Buffer Overflow Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 10/26/05

  • Next message: SecuriTeam: "[EXPL] Net Portal Dynamic System Denial of Service Exploit"
    To: list@securiteam.com
    Date: 26 Oct 2005 19:18:49 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.

    - - - - - - - - -

      Snort Back Orifice Preprocessor Buffer Overflow Vulnerability


     <http://www.snort.org/> Snort is a widely-deployed, open-source network
    intrusion detection system (IDS). Snort preprocessors are modular plugins
    that extend functionality by operating on packets before the detection
    engine is run.

    The Snort Back Orifice preprocessor contains a buffer overflow that could
    allow a remote attacker to execute arbitrary code on a vulnerable system.


    Vulnerable Systems:
     * Snort versions 2.4.0 to 2.4.2
     * Sourcefire Intrusion Sensors

    The Back Orifice preprocessor decodes packets to determine if they contain
    Back Orifice ping messages. The ping detection code does not adequately
    limit the amount of data that is read from the packet into a fixed-length
    buffer, thus creating the potential for a buffer overflow.

    The vulnerable code will process any UDP packet that is not destined to or
    sourced from the default Back Orifice port (31337/udp). An attacker could
    exploit this vulnerability by sending a specially crafted UDP packet to a
    host or network monitored by Snort.

    The Snort Back Orifice preprocessor vulnerability can be triggered with a
    single UDP packet targeting virtually any port. As such, there is a large
    potential that these packets can bypass perimeter firewall defenses. An
    attack need not be directly targeted at a Snort installation, but merely
    towards a network monitored by Snort. Due to the trivial nature of this
    vulnerability and its potential to bypass perimeter firewalls, there is
    grave concern that this issue might be exploited as part of a
    network-based worm.

    A remote attacker who can send UDP packets to a Snort sensor may be able
    to execute arbitrary code. Snort typically runs with root or SYSTEM
    privileges, so an attacker could take complete control of a vulnerable
    system. An attacker does not need to target a Snort sensor directly; the
    attacker can target any host or network monitored by Snort.

    US-CERT is tracking this vulnerability as
    <http://www.kb.cert.org/vuls/id/175500> VU#175500. Further information is
    available in an <http://xforce.iss.net/xforce/alerts/id/207> advisory
    from Internet Security Systems (ISS).


    The original article can be found at:


    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com


    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Net Portal Dynamic System Denial of Service Exploit"