We have relaunched: What's new at ZDNet Asia?

Open-source intrusion detector found to be flawed

Summary

Sourcefire says hackers could potentially execute malicious code on a system running earlier versions of Snort.

Events

Microsoft MSDN/Developer Event
25 Mar 2010

One Marina Boulevard, Microsoft Singapore

IT Architect Regional Conference Singapore 2010
20 - 21 Apr 2010

Singapore Management University, Singapore

The Internet Show 2010
21-22 Apr 2010

Suntec Singapore

Snort, the open-source intrusion-detection software, is vulnerable to hackers, its developers said this week.

Snort's popularity has grown as many businesses have been tempted away from expensive proprietary intrusion-detection systems. Advocates of Snort argue that it is more secure than products created by network gear makers such as Cisco Systems because its code is open for developers to both find and fix flaws.

But on Monday, Sourcefire, the company behind Snort, said that hackers could potentially execute malicious code on a system running Snort and gain access to confidential data.

The vulnerability was reported to Sourcefire by Internet Security Systems, the security arm of IBM.

Reporting the weakness, an Internet Security Systems report said: "Snort IDS and Sourcefire Intrusion Sensor (intrusion-detection/prevention system) are vulnerable to a stack-based buffer overflow, which can result in remote code execution…Compromise of machines using affected versions of Snort or Sourcefire may lead to exposure of confidential information, loss of productivity and further compromise. Successful exploitation of this vulnerability results in remote code execution with the privilege level of Snort, usually root or system."

Internet Security Systems said the following products are affected: Snort 2.6.1, 2.6.1.1, and 2.6.1.2; Snort 2.7.0 beta 1; Sourcefire Intrusion Sensors versions 4.1.x, 4.5.x, and 4.6.x with SEUs prior to SEU 64; Sourcefire Intrusion Sensor Software for Crossbeam versions 4.1.x, 4.5.x and 4.6.x with SEUs prior to SEU 64

Those using version 2.6.1, 2.6.1.1 or 2.6.1.2 should upgrade to 2.6.1.3, which is not vulnerable, Snort said. Users of version 2.7 should disable the DCE/RPC preprocessor, the program that contains the vulnerability. Version 2.7 is currently in beta, and the issue will be resolved in a second beta version, Snort said.

Talkback

Add your opinion

In order to post a comment, you need to be registered. (Sign In or register below)

Post your comment
Transform your business interactions with real-time voice, video and telepresence solutions.
Tech Vendor: Cisco

ZDNet Asia Live

whatever little understanding I have we 'll only progress toward end of the world if we use HPCs to lenthen life of human being. Huma...

3 hours 16 minutes ago by abhi32002@gmail.com on High computing promises elixir of life

Thanks for the knowledgeable article on SDDs. Allas...when all this reasearch will happen in Indian Universities. Hope the new bill on Fo...

3 hours 29 minutes ago by abhi32002@gmail.com on APAC HPC users eye solid-state drives

It was a good article. This brings a good opportunity for Indian IT firms to come up with new solutions in this field. HPC can become a b...

3 hours 47 minutes ago by abhi32002@gmail.com on High computing most-wanted job in Asia

COL KR DHARMADHIKARY(RETD) its very late to reply the link, but if it is still alive and looking for opportunity, i would like to know th...

7 hours 45 minutes ago by deb021280 on Education takes off in rural India, helped by PCs

It was just a matter of time until google was marginalised anyway. I'm afraid this will be forgotten in China very quickly. Still, it...

9 hours 49 minutes ago by robinsmith on Report: Google to leave China on April 10

High performance computing (HPC) most-wanted job in Asia http://bit.ly/9vFC3i (via @zdnetasia) #singapore

He doesn't care if her shoes are of glass, All he wants to see is a huge rack and nice a*s. Sleeping beauty's not awoken by true ...

10 hours 18 minutes ago by warlowdavies on One pair of 3D glasses to rule them all

RT @zdnetasia: EMC COO, Pat Gelsinger, on bridging gaps in the organization and its cloud ambitions in Asia. (cont) http://tl.gd/i5jjd

EMC COO, Pat Gelsinger, on bridging gaps in the organization and its cloud ambitions in Asia. http://bit.ly/9etOZW

Spoke to EMC COO, Pat Gelsinger, earlier, and here's the account of the interview: http://bit.ly/9etOZW

11 hours 39636 seconds ago by kevinzdnetasia on topsy

Asian SMBs need to pay more attention to disaster recovery planning http://bit.ly/bDet08 via @zdnetasia

Asian SMBs need to pay more attention to disaster recovery planning http://bit.ly/bDet08

Experts: social media guidelines good for upcoming Youth Olympic Games, but focus on cooperation, not enforcement. http://bit.ly/d9M0BQ

11 hours 32 minutes ago by zdnetasia on topsy

Asian SMBs need to pay more attention to disaster recovery planning http://bit.ly/bDet08

11 hours 33 minutes ago by kevinzdnetasia on topsy

ZDNet Asia features IBM collaboration roadmap story from LCTY Singapore - http://bit.ly/9CuSbZ #lotusknows

12 hours 27 minutes ago by lotusknows on topsy

[TECH] URL Shorteners slow Web redirection. - http://bit.ly/bySnWK @zdnetasia

URL shorteners are great but they can slow web redirection & you pray it would never go down http://bit.ly/bySnWK via @zdnetasia

Temasek Holdings eyeing tech stocks, indicating optimistic outlook on IT sector. http://bit.ly/aM7VwU

URL shorteners slow Web redirection. http://bit.ly/bySnWK

Chinese agencies cry foul over Google. http://bit.ly/by6rwV

Philippine antipiracy drive focuses on enterprises. http://bit.ly/aWryDC

Gartner: China to become world's fastest-growing enterprise software market. http://bit.ly/bqJTtb

all of sg's isps have been practising compulsory invisible proxy for all home subscribers at their backend since many years back alre...

1 day 28 minutes ago by melvinchia on Web filters mean bad news for business

it is not to good for china.
Proactol

1 day 13 minutes ago by nathonastle on Chinese ad partners beg Google for information

RT @zdnetasia: HP touts new products and management and productivity tools to address business computing pain points. http://bit.ly/dudgA6

For those with a computer science background, or interested in the high performance computing scene: http://bit.ly/9vFC3i

HP touts new products and management and productivity tools to address business computing pain points. http://bit.ly/dudgA6

Very good explanation of JMX

2 days 18 minutes ago by Babith B on Managing applications with JMX

The reaction to a report issued Tuesday by Flurry Analytics managed to completely overlook some interesting news--the Android-based Motorola Droid outsold the original iPhone over the same period of time following their respective launches--to focus instead on the sales numbers for the Nexus One.

2 days 22 minutes ago by lonemavericks on diggs

Another ZTE story....

2 days 24 minutes ago by Moderate Your Greed on Philippines opens bid for final 3G license

We at www.fifosys.com have also seen a growth in IT outsourcing and anticipate it as a growing field.

2 days 57 minutes ago by sarah Jane on Companies' outsourcing spend to increase

I agree with you. The iSiVaL is super portable and TVs can't expand their image size. I recorded a video that might bring some ideas to...

3 days 27 minutes ago by Jesse B Andersen on Buying a projector? Try an LED TV instead

hermm... he deserved it.. he shud not talk abt sensitive things like tat, well, he shud think twice before saying all those things, event...

3 days 5 minutes ago by ... on Facebook user charged in Malaysia

Password manager tools are potential security threat. Criminals who hack into the computer can use the password manager to log onto any s...

3 days 6 minutes ago by ohanae on What defaults should random password generators use?

I've found the cross platform utility unetbootin to be rather handy for this kind of thing as well.

3 days 40 minutes ago by Jim on Use Live USB Creator to install Fedora 12 from a USB stick