Integer overflow in the TCP stream reassembly module (stream4) for Snort 2.0 and earlier allows remote attackers to execute arbitrary code via large sequence numbers in packets, which enable a heap-based buffer overflow.

The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows remote attackers to cause a denial of service (crash) via packets with invalid TCP/IP options, which trigger a null dereference.

Stack-based buffer overflow in the Back Orifice (BO) preprocessor for Snort before 2.4.3 allows remote attackers to execute arbitrary code via a crafted UDP packet.

Description of problem:

Sourcefire has learned of a remotely exploitable vulnerability in the Snort DCE/RPC preprocessor. This preprocessor is vulnerable to a stack-based buffer overflow that could potentially allow attackers to execute code with the same privileges as the Snort binary. Sourcefire has prepared updates for Snort open-source software to address this issue.

Version-Release number of selected component (if applicable): Snort Versions Affected:

Snort 2.6.1, 2.6.1.1, and 2.6.1.2 Snort 2.7.0 beta 1

How reproducible:

Steps to Reproduce: 1. 2. 3. Actual results:

Expected results:

Additional info:

The HTTP Inspect preprocessor (httpinspect) in Snort 2.4.0 through 2.4.4 allows remote attackers to bypass "uricontent" rules via a carriage return (\r) after the URL and before the HTTP declaration.

The frag3 preprocessor in Sourcefire Snort 2.4.3 does not properly reassemble certain fragmented packets with IP options, which allows remote attackers to evade detection of certain attacks, possibly related to IP option lengths.

The web-based management interfaces in Sourcefire Defense Center (DC) and 3D Sensor before 4.8.2 allow remote authenticated users to gain privileges via a $admin value for the admin parameter in an edit action to admin/user/user.cgi and unspecified other components.

The default installation of Sourcefire 3D Sensor 1000, 2000, and 9900; and Defense Center 1000; uses the same static, private SSL keys for multiple devices and installations, which allows remote attackers to decrypt SSL traffic via a man-in-the-middle (MITM) attack.

Snort upstream has released 2.8.5.1 version, addressing one security issue (from upstream release notes):

Fixed potential segfault when printing IPv6 packets using the -v option. Thanks to Laurent Gaffie for reporting this issue.

References: ----------- http://vrt-sourcefire.blogspot.com/2009/10/snort-2851-release.html http://www.snort.org/downloads http://secunia.com/advisories/37135/

PoC: http://seclists.org/fulldisclosure/2009/Oct/299 ----

Credit: ------- Laurent Gaffié

CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/10/25/3