From the Advisory: A buffer overflow flaw exists in Snort RPC preprocessing code that is vulnerable to attack. Impact: Remote attackers may exploit the buffer overflow condition to run arbitrary code on a Snort sensor with the privileges of the Snort IDS process, which typically runs as the superuser[1]. The vulnerable preprocessor is enabled by default. It is not necessary to establish an actual connection to a RPC portmapper service to exploit this vulnerability. [1] runs as user snort on Gentoo by default - but still has access to all network traffic Solution: Upgrade to 1.9.1 or disable the rpc pre-processor as temporary work-around. Note: disabling the rpc pre-processor disables all rpc based detection. Reproducible: Always Steps to Reproduce:
*** Bug 16811 has been marked as a duplicate of this bug. ***
glsa sent
