Buffer overflow in the RPC preprocessor for Snort 1.8 and 1.9.x before 1.9.1 allows remote attackers to execute arbitrary code via fragmented RPC packets.

Two vulnerabilities have been discovered in Snort, a popular network intrusion detection system. Snort comes with modules and plugins that perform a variety of functions such as protocol analysis. The following issues have been identified :

Heap overflow in Snort 'stream4' preprocessor (VU#139129, CAN-2003-0209, Bugtraq Id 7178)Researchers at CORE Security Technologies have discovered a remotely exploitable integer overflow that results in overwriting the heap in the 'stream4' preprocessor module. This module allows Snort to reassemble TCP packet fragments for further analysis. An attacker could insert arbitrary code that would be executed as the user running Snort, probably root.Buffer overflow in Snort RPC preprocessor (VU#916785, CAN-2003-0033, Bugtraq Id 6963)Researchers at Internet Security Systems X-Force have discovered a remotely exploitable buffer overflow in the Snort RPC preprocessor module. Snort incorrectly checks the lengths of what is being normalized against the current packet size. An attacker could exploit this to execute arbitrary code under the privileges of the Snort process, probably root.

A buffer overflow was discovered in the snort RPC normalization routines by ISS-XForce which can cause snort to execute arbitrary code embedded within sniffed network packets. The rpc_decode preprocessor is enabled by default. The snort developers have released version 1.9.1 to correct this behaviour; snort versions from 1.8 up to 1.9.0 are vulnerable.

For those unable to upgrade, you can disable the rpc_decode preprocessor by commenting out the line (place a '#' character at the beginning of the line) that enables it in your snort.conf file :

preprocessor rpc_decode

ID	Name	Product	Family	Severity
15134	Debian DSA-297-1 : snort - integer overflow, buffer overflow	Nessus	Debian Local Security Checks	critical
14013	Mandrake Linux Security Advisory : snort (MDKSA-2003:029)	Nessus	Mandriva Local Security Checks	critical

Detections

Analytics

CVE-2003-0033

critical

Tenable Plugins

critical

critical