Slashdot Mirror
Remote Code Execution Hole Found In Snort
Palljon1123 writes "A stack-based buffer overflow in the Snort intrusion detection system could leave government and enterprise installations vulnerable to remote unauthenticated code execution attacks. The flaw, found by researchers at IBM's ISS X-Force, affects the Snort DCE/RPC preprocessor and could be used to execute code with the same privileges (usually root or SYSTEM) as the Snort binary. No user action is required." Sourcefire has an update to fix the vulnerability in versions 2.6.1, 2.6.1.1, and 2.6.1.2; Heise Security spells out the workaround for the 2.7.0 beta version.
Boaring!
Navicula hydraulica plena anguilarum est. Omnes castelli tuus nostri sunt. Ed elli avea del cul fatto trombetta.
Also covering this one: SANS ICS
Something designed to make your network secure turning out to be a security risk...
Its a remote overflow, does it work if the sensor doesn't have an IP address? If it merely sees the right pattern of 1s and 0s on the wire, it roots itself? Article sadly lacking detail.
I want to delete my account but Slashdot doesn't allow it.
...Microsoft's fault.
People who run linux don't have any money to steal.
It is interesting this vulnerability makes it into Slashdot where other [past Snort/Sourcefire] vulnerabilities of the same magnitude have not. It would definitely be time to upgrade but the number of people running 2.6.1, 2.6.1.1, 2.6.1.2 and 2.7.0 beta 1 are probably not as wide spread as 2.4.x, 2.6.0, and probably earlier versions. Luckily this vulnerability has been identified by a bunch of good researchers and the potential exploit probably hasn't been developed by anyone malicious. The real fear here of course is not just that *a box* might get rooted.. it's that a box running Snort/Sourcefire might get rooted. Generally this box will of course sit inline on the network or have sort of span/mirror port running to it. Whenever an IDS, switch, or router compromise is possible it can truly spell bad news. However, I'd say in this case it's not likely that a whole lot would happen even if an exploit should be developed.
What's the Snort signature for this?
Would be somewhat helpful saying "Hey look somebody is rooting me!"
Your hair look like poop, Bob! - Wanker.
You shouldn't have the DCE/RPC preprocessor running, you shouldn't be exposing RPC to the internet anyway. FC6 default install of 2.1.1.2 has it disabled in snort.conf.
There are some instances where this should be running such as internal traffic monitoring, but I don't see how this can hit people from the internet with fragmented RPC traffic unless they're allowing it at the firewall.
Also, don't run any network service as root. FC6 install of snort does run as root by default, kinda lame.
-u username -g groupname arguments in the init script when starting the daemon will make it run as username:groupname credentials. nobody:nogroup maybe. Consider also chroot jail.
Old tips http://isc.sans.org/diary.html?date=2005-10-18
Why oh why are we in 2007 seeing code like this in security apps? input verification in the classical C way with pointer arithmetic on strings.
/* go to the end of the string */
/* the last non-whitspace character should be a ')' */
/* the next to last char should be a semicolon */ ...
(and no, the error isn't there, it's just the first thing I came across in the snort source)
Why are they even using C? Suprise, they make exploitable buffer overflow attacks! And they still have one verified, non-fixed issue detected by coverity, plus 33 "uninspected and pending" according to coverity's scan.
int CheckRule(char *str)
{
int len;
int got_paren = 0;
int got_semi = 0;
char *index;
len = strlen(str);
index = str + len - 1;
while((isspace((int)*index)))
{
if(index > str)
index--;
else
return 0;
}
if(*index == ')')
{
got_paren = 1;
index--;
}
while((isspace((int)*index)))
{
if(index > str)
index--;
else
return 0;
}
if(*index == ';')
xkcd is not in the sudoers file. This incident will be reported.