Sourcefire Inc. has updated its popular open source Snort IDS tool
to plug security holes an attacker could exploit to cause a denial
of service or launch malicious code.
The vendor said in a its Sourcefire
advisory that the flaw is in the Snort DCE/RPC preprocessor.
"This preprocessor is vulnerable to a stack-based buffer overflow
that could potentially allow attackers to execute code with the
same privileges as the Snort binary," the company said.
The problem affects Snort 2.6.1, 2.6.1.1, and 2.6.1.2; and Snort
2.7. beta 1. Users are advised to neutralize the flaw by upgrading
to Snort version 2.6.1.3 or 2.7 beta 2.
The French Security Incident Response Team (FrSIRT)
described
the flaw as a critical buffer overflow error within the DCE/RPC
preprocessor -- enabled by default -- that surfaces when malformed
data is processed via the "ReassembleSMBWriteX()" and
"ReassembleDCERPCRequest()" functions. This "could be exploited by
attackers to compromise a vulnerable system by sending specially
crafted packets to a network being monitored by a vulnerable
application," FrSIRT said.
Sourcefire, based in Columbia, Md., commercialized the widely
popular Snort tool and has made inroads the last couple of years in
the emerging intrusion prevention market. The company announced
late last year that it had
filed with the U.S. Securities and Exchange Commission to raise
up to $75 million in an initial public offering (IPO) of stock.
The company ran into controversy in 2005 when
Check Point announced plans to acquire it for $225 million in
cash.
The
deal was unpopular among die-hard Snort users. Some feared
Check Point would allow Snort to languish, as some feel it has done
since it acquired the popular free ZoneAlarm desktop firewall
application as part of its $205 million purchase of Zone Labs in
2003. Others worried that Check Point would seek to further
monetize Snort by no longer allowing it to be an open source
product.
The Israeli enterprise security company ran into trouble with
the Committee on Foreign Investment in the United States (CFIUS),
which scrutinized the deal amid concerns that foreign ownership of
Snort would threaten U.S. national security.
It became a moot point last March, when
Check Point withdrew its application to acquire Sourcefire.