Snort 'rule20275eval () 'function Stack Buffer Overflow Vulnerability

Release date:
Updated on: 2013-01-23

Affected Systems:
Snort Project Snort 2.9.4.0
Snort Project Snort 2.9.3.1
Snort Project Snort 2.9.2.3
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57476
 
Snort is a widely deployed open-source network intrusion detection system (IDS ).
 
When Snort 2.9.4.0, 2.9.3.1, 2.9.2.3 and other versions parse DCE/RPC responses, there is a boundary verification error in the "rule20275eval ()" function (netbios_kb961501-smb-printss-reponse.c, when an attacker sends malformed data packets, the application stack buffer overflow vulnerability can be exploited to execute arbitrary code. To exploit this vulnerability, you must enable the rule "3-20275 ".
 
<* Source: Tavis Ormandy (taviso@gentoo.org)

Link: http://secunia.com/advisories/51901/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Snort Project
-------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://www.snort.org/