From aliz@gentoo.org Thu Mar 6 19:14:40 2003 From: Daniel Ahlberg To: full-disclosure@lists.netsys.com Date: Thu, 6 Mar 2003 11:59:42 +0100 Subject: [Full-Disclosure] GLSA: snort (200303-6) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200303-6 - - --------------------------------------------------------------------- PACKAGE : snort SUMMARY : remote dos DATE : 2003-03-06 10:59 UTC EXPLOIT : remote VERSIONS AFFECTED : <1.9.1 FIXED VERSION : =>1.9.1 CVE : CAN-2003-0033 - - --------------------------------------------------------------------- - From advisory: "Remote attackers may exploit the buffer overflow condition to run arbitrary code on a Snort sensor with the privileges of the Snort IDS process, which typically runs as the superuser. The vulnerable preprocessor is enabled by default. It is not necessary to establish an actual connection to a RPC portmapper service to exploit this vulnerability." Read the full advisory at: http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21951 SOLUTION It is recommended that all Gentoo Linux users who are running net-analyzer/snort upgrade to snort-1.9.1 as follows: emerge sync emerge -u snort emerge clean - - --------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at http://cvs.gentoo.org/~aliz - - --------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE+ZyoSfT7nyhUpoZMRAkWXAJ9o4osrNsPeB3zW9Z0waUyqkgdqrwCcCdVm eJHeuzr13368L/eFJK0uqLs= =apAA -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html