National Cyber-Alert System

Vulnerability Summary for CVE-2006-5276

Overview

Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire Intrusion Sensor; allows remote attackers to execute arbitrary code via crafted SMB traffic.

Description

All affected Sourcefire Intrustion Sensor products are only vulnerable if they are used with SEUs prior to SEU 64.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

Upgrade to the latest version of Snort (2.6.1.3 or later), available from the Snort Web site.}

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA07-050A

Name: TA07-050A

Type: Advisory

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA07-050A.html

US-CERT Vulnerability Note: VU#196240

Name: VU#196240

Hyperlink:http://www.kb.cert.org/vuls/id/196240

External Source: XF

Name: smb-bo(31275)

Hyperlink:http://xforce.iss.net/xforce/xfdb/31275

External Source: CONFIRM

Name: http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=540173

Hyperlink:http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=540173

External Source: CONFIRM

Name: http://www116.nortelnetworks.com/pub/repository/CLARIFY/DOCUMENT/2007/08/021923-01.pdf

Hyperlink:http://www116.nortelnetworks.com/pub/repository/CLARIFY/DOCUMENT/2007/08/021923-01.pdf

External Source: CONFIRM

Name: http://www.snort.org/docs/advisory-2007-02-19.html

Type: Advisory

Hyperlink:http://www.snort.org/docs/advisory-2007-02-19.html

External Source: SECTRACK

Name: 1017670

Hyperlink:http://www.securitytracker.com/id?1017670

External Source: SECTRACK

Name: 1017669

Hyperlink:http://www.securitytracker.com/id?1017669

External Source: BUGTRAQ

Name: 20070303 ERRATA: [ GLSA 200703-01 ] Snort: Remote execution of arbitrary code

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/461810/100/0/threaded

External Source: OSVDB

Name: 32094

Hyperlink:http://www.osvdb.org/32094

External Source: MILW0RM

Name: 3362

Hyperlink:http://www.milw0rm.com/exploits/3362

External Source: VUPEN

Name: ADV-2007-0668

Hyperlink:http://www.frsirt.com/english/advisories/2007/0668

External Source: VUPEN

Name: ADV-2007-0656

Hyperlink:http://www.frsirt.com/english/advisories/2007/0656

External Source: GENTOO

Name: GLSA-200703-01

Hyperlink:http://security.gentoo.org/glsa/glsa-200703-01.xml

External Source: SECUNIA

Name: 24272

Hyperlink:http://secunia.com/advisories/24272

External Source: SECUNIA

Name: 24240

Hyperlink:http://secunia.com/advisories/24240

External Source: SECUNIA

Name: 24239

Hyperlink:http://secunia.com/advisories/24239

External Source: SECUNIA

Name: 24235

Hyperlink:http://secunia.com/advisories/24235

External Source: SECUNIA

Name: 24190

Hyperlink:http://secunia.com/advisories/24190

External Source: ISS

Name: 20070219 Sourcefire Snort Remote Buffer Overflow

Type: Advisory

Hyperlink:http://iss.net/threats/257.html

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=229265

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=229265

External Source: BID

Name: 22616

Hyperlink:http://www.securityfocus.com/bid/22616

External Source: SECUNIA

Name: 26746

Hyperlink:http://secunia.com/advisories/26746

External Source: FEDORA

Name: FEDORA-2007-2060

Hyperlink:http://fedoranews.org/updates/FEDORA-2007-206.shtml