[security-alerts] FW: [SA17220] Snort Back Orifice Pre-Processor Buffer Overflow Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> 
> TITLE:
> Snort Back Orifice Pre-Processor Buffer Overflow Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA17220
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/17220/
> 
> CRITICAL:
> Highly critical
> 
> IMPACT:
> System access
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> Snort 2.4.x
> http://secunia.com/product/5691/
> 
> DESCRIPTION:
> Neel Mehta has reported a vulnerability in Snort, which can be
> exploited by malicious people to compromise a vulnerable system.
> 
> The vulnerability is caused due to a boundary error in the handling
> of Back Orifice packets. This can be exploited by sending a
> maliciously crafted UDP packet to a network or device protected by or
> running an IDS or IPS system based on Snort.
> 
> The vulnerability has been reported in Snort version 2.4.0 , 2.4.1,
> and 2.4.2. Other versions may also be affected.
> 
> SOLUTION:
> Upgrade to version 2.4.3.
> 
> Alternatively, disable the Back Orifice pre-processor.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Neel Mehta, ISS X-Force
> 
> ORIGINAL ADVISORY:
> Snort:
> http://www.snort.org/pub-bin/snortnews.cgi#99
> 
> X-Force:
> http://xforce.iss.net/xforce/alerts/id/207
> 
> OTHER REFERENCES:
> US-CERT VU#175500:
> http://www.kb.cert.org/vuls/id/175500
> 
> ----------------------------------------------------------------------