search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Heap overflow in Snort "stream4" preprocessor

Vulnerability Note VU#139129

Original Release Date: 2003-04-16 | Last Revised: 2003-05-20

Overview

The Snort "stream4" preprocessor module contains a vulnerability that allows remote attackers to execute arbitrary code with the privileges of the user running Snort, typically root.

Description

Researchers at CORE Security Technologies have discovered a remotely exploitable heap overflow in the Snort "stream4" preprocessor module. This module allows Snort to reassemble TCP packet fragments for further analysis.

To exploit this vulnerability, an attacker must disrupt the state tracking mechanism of the preprocessor module by sending a series of packets with crafted sequence numbers. This causes the module to bypass a check for buffer overflow attempts and allows the attacker to insert arbitrary code into the heap.

For further information, please read the Core Security Technologies Advisory located at

http://www.coresecurity.com/common/showdoc.php?idx=313&idxseccion=10

This vulnerability affects Snort versions 1.8.x, 1.9.x, and 2.0 prior to RC1.

Impact

This vulnerability allows remote attackers to execute arbitrary code with the privileges of the user running Snort, typically root. Please note that it is not necessary for the attacker to know the IP address of the Snort device they wish to attack; merely sending malicious traffic where it can be observed by an affected Snort sensor is sufficient to exploit these vulnerabilities.

Solution

Upgrade to Snort 2.0

This vulnerability is addressed in Snort version 2.0, which is available at

http://www.snort.org/dl/snort-2.0.0.tar.gz

Binary-only versions of Snort are available from

http://www.snort.org/dl/binaries

Disable the "stream4" preprocessor module

Sites that are unable to immediately upgrade affected Snort sensors may prevent exploitation of this vulnerability by commenting out the affected preprocessor module in the "snort.conf" configuration file. To do this, comment out the following line:

preprocessor stream4_reassemble

After commenting out the affected module, send a SIGHUP signal to the affected Snort process to update the configuration. Note that disabling this module may have adverse effects on a sensor's ability to correctly process TCP packet fragments. In particular, disabling this module will prevent the Snort sensor from detecting a variety of IDS evasion attacks.

Block outbound packets from Snort IDS systems

You may be able limit an attacker's capabilities if the system is compromised by blocking all outbound traffic from the Snort sensor. While this workaround will not prevent exploitation of the vulnerability, it may make it more difficult for the attacker to create a useful exploit.

Vendor Information

139129
 
Expand all

View all 33 vendors View less vendors


CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

This vulnerability was discovered by Bruce Leidl, Juan Pablo Martinez Kuhn, and Alejandro David Weil of Core Security Technologies.

This document was written by Jeffrey P. Lanza.

Other Information

CVE IDs: CVE-2003-0209
CERT Advisory: CA-2003-13
Severity Metric: 30.99
Date Public: 2003-04-15
Date First Published: 2003-04-16
Date Last Updated: 2003-05-20 01:03 UTC
Document Revision: 22

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis