Summary
=======

Snort with the Prelude reporting patch is vulnerable to a DOS when specific
rules or rulesets are enabled, and packets matching those rules are
detected.

The 2.0.x revision of Snort, with the Snort Reporting Patch before version 
0.2.6 is vulnerable.  Earlier versions of Snort are probably also affected.

Vulnerability details
=====================

In a prelude-patched instance of Snort, spo_prelude is called to log events
to the prelude-manager system.  The spo_prelude plugin as available before
version 0.2.6 doesn't properly check to ensure the variable classtype is
set before attempting to log it.  When run in gdb, snort will exit with this
message, due to a NULL pointer dereference:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1074864960 (LWP 24660)]
0x0806bb49 in AlertPrelude (p=0xbfffe5e0,
    msg=0x8782b98 "BACKDOOR typot trojan traffic", arg=0x8224d30,
    event=0x8782990) at spo_alert_prelude.c:622
622                             if (strcmp(impact->short_descr,
otn_tmp->sigInfo.classType->type) == 0) {

The rule that caused this segfault:

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BACKDOOR typot trojan
traffic"; stateless; flags:S,12; window:55808; sid:2182; rev:2;)

An attacker with some knowledge that a Snort system with Prelude reporting
was in place could generate traffic that would trigger rules missing the
classtype keyword and create a DOS against Snort.  The actual number of
rules available without classtype is limited (8 when this advisory was
written).

Solution
========

Either download the new version (0.2.6 or later) of the Prelude reporting
patch from http://www.prelude-ids.org, disable all Snort alerts that don't
contain the classtype keyword, or add the classtype keywords in rules where
it is missing.

About Prelude
=============

Prelude is a new innovative Hybrid Intrusion Detection system designed to be
very modular, distributed, rock solid and fast. Prelude can be used to
consolidate event data from multiple sources, including Snort, providing
both NIDS and HIDS functionality in a single interface. More information can
be found at http://www.prelude-ids.org.

About the Snort Prelude Reporting Patch
=======================================

Snort Prelude Output Plugin (spo_alert_prelude) allows snort to communicate
with Manager of the Prelude Hybrid IDS Suite version 0.8.x.  It is written
and maintained by Krzysztof Zaraska, a member of the Prelude development
team. More information about Krzysztof can be found at
http://mops.uci.agh.edu.pl/~kzaraska/.

Credits
=======

This advisory was drafted by Gene Gomez on behalf of Tyco Fire & Security
Global Technology Services.


--- { CHANGES } ---

- Version 0.2.6, for Snort 2.0.2,2.0.6
                
- Fixed a crash when triggered rule had no "classtype" parameter (possible
  DoS).

- Fixed output of TCP parameters (seq, ack, wsize) on little-endian machines. 




--- { DOWNLOAD } ---

http://prelude-ids.org/download/releases/snort-prelude-reporting-patch-0.2.6.tar.gz
http://prelude-ids.org/download/releases/snort-prelude-reporting-patch-0.2.6.tar.gz.sig
http://prelude-ids.org/download/releases/snort-prelude-reporting-patch-0.2.6.tar.gz.md5


--- { MD5SUM } ---

31ba8588ec29227c7b3f7ac64ff4c947  snort-prelude-reporting-patch-0.2.6.tar.gz


--- { OpenPGP key } ---

gpg --keyserver wwwkeys.pgp.net --recv-keys 0x23D2FAC3


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iQIVAwUBQCfBQBHxO34j0vrDAQKA6A//dji6u9oNYq4wiEI2F9XtfbmBEYcUWOmF
6QK4yg+S4Vs8iteZfbmze25UxTfU5KsCczrcuPmok0Y29K8y/hnWsxcs6vPpiUtI
i/g/kdDTuhMJHYi02YexsyrD2UN0VQeF0KDaCj9qYnZecB8DBVZzFL9+YGzBRVJQ
bACLvjBMWt8YL7rhtrMbR2AORwjdowz0pWVeNqjOMvBhnE/oPuoi2XyU5RnbRzxD
B9Cquf6QR+sr4z96EYQmDamP5s7YtSvRYeCDK+r8UBpWjztmm1Uj+1TixA/BvZv0
+QU6vu7GeQhZyk+xChqcJ1kbnh+DXfo7hyFEq9k/rU4Noi/y9wGx7SzV/XtfXLmJ
wc803iqlDPs2PhUPn1Bu05ZARA160S7EN1wfb+EbcJF9II0S/3SlxENccHgb1rcw
SOdDib1MU2Y3zK5qAOtuPogR7jxs5wpQHtxCL9aVJIAsJZI4NkAt9RWlSuj0MbTu
VO+afPjXPH6cwcfzMoWrHQ+z5RhUN+4RvvdFbXesx0HMQ9wO8ZxkqsWo2kYmhlhx
T3zdJ7jF4O1AI1D1inmWJeyNm9bhN6pDjM+Ed+0IBpjHXzrbJcZm7HDEbmouwrNv
aOiUnRlHXhDt781oyNFbe5orVfFdKFVe8/vY20hhxfrYala3/ELheQRDtOofNvM8
3CWU45jQwNE=
=XXKL
-----END PGP SIGNATURE-----