ISS reports Snort vulnerability

A software vulnerability in the widely used Snort open-source intrusion detection system (IDS) software could allow an attacker to crash the Snort sensor or gain control of the host device on which the sensor runs.

Snort serves as the basis for commercial IDS products such as those produced by Sourcefire and can be used to detect a wide range of network attacks and probes, such as attempted buffer overflows and port scans.

A buffer overflow vulnerability was found in code used by Snort to detect an attack technique called RPC (remote procedure call) fragmentation. RPC fragmentation can be used to evade intrusion detection systems, according to an advisory reported Monday by security vendor Internet Security Systems Inc. (ISS).

RPC is a protocol that one software program can use to request a service from a program located in another computer in a network.

Snort does not properly check the size of the RPC fragments it is processing against the available space in the preprocessing buffer. Sending data to the buffer in excess of its capacity causes the buffer to overflow. Buffer overflows may cause the Snort sensor to crash or enable an attacker to place and execute malicious code on the compromised host, ISS said.

To exploit the vulnerability, attackers would need to craft RPC traffic to specifically exploit the buffer overflow. Attackers would not, however, need to know the address of the Snort sensor they are targeting. Simply sending exploit packets to a network that is protected by a Snort sensor is sufficient to launch an attack, ISS said.

Because Snort sensors and other IDS products typically guard against intrusion into critical networks, the compromise of a Snort sensor could lead to highly sensitive network traffic being accessible to remote attackers. That traffic could, in turn, yield information needed to compromise internal network resources, according to ISS.

All versions of Snort since version 1.8, released in July 2001, are affected by the RPC vulnerability, ISS said. A new version of the Snort software that fixes the RPC vulnerability, version 1.9.1, was available on the Snort Web page as of Tuesday.

ISS recommended that Snort users consult the Snort Web page at http://www.snort.org and upgrade their source implementation using patches or software upgrades available there.

Users who are unable to upgrade their Snort installation should disable the RPC preprocessor until they can upgrade, ISS said.