Security Bytes: Snort systems vulnerable to attack

By SearchSecurity.com Staff 01 Jun 2006 | SearchSecurity.com

Digg This!     StumbleUpon     Del.icio.us

Cupertino, Calif.-based AV giant Symantec Corp. warned customers of its DeepSight Threat Management System early Thursday that the freely available intrusion detection system is prone to a detection-invasion vulnerability. The issue was discovered by Carpenteria, Calif.-based security vendor Demarc Security Inc., which released its own fix along with its bulletin.

Likely due to a design error in Snort, Symantec said the problem affects Snort version 2.4.4, but may be an issue with other versions as well. It occurs when a malicious URL has a carriage return at the end, just prior to the HTTP protocol declaration. Such a URL can enable an attacker to successfully bypass "uricontent" rules to carry out an attack against a system being protected by Snort.

Symantec said it is currently unaware of any exploits for the flaw. Sourcefire Inc., the maker of Snort, has not yet issued a fix, but plans to do so early next week. Symantec recommends that organizations using Snort mitigate the issue by making use of multiple layers of security and filtering, including firewalls, antivirus and intrusion detection software.

IBM addresses Kerberos flaws
IBM says it has remedied a pair of vulnerabilities in its Distributed Computing Environment (DCE) that could result in a denial of service.

The flaws in DCE, which are a set of networking technologies from Big Blue that enable secure access to network resources using public key infrastructure (PKI) and supporting Lightweight Directory Access Protocol (LDAP), have been deemed extremely critical by Danish vulnerability clearinghouse Secunia.

According to IBM, an issue with the Massachusetts Institute of Technology's Kerberos 5 implementation Key Distribution Center (KDC) "can corrupt the heap by attempting to free memory at a random address when it receives a certain unlikely (but valid) request via a TCP connection. This attempt to free unallocated memory can result in a KDC crash and consequent denial of service."

Additionally, IBM said, when the same request is received by the KDC via TCP or UDP, it may activate a flaw in the Kerberos 5 library that results in a single-byte overflow of a heap buffer. Though it calls an attack of this nature "highly improbably," IBM said an unauthenticated attacker may be able to use the vulnerabilities to execute arbitrary code on the KDC host system to potentially compromise an entire Kerberos realm.

IBM said there are currently no known exploits. In its bulletin it recommends that customers disable TCP support in the KDC, and run the KDC "from init or from some similar automatic respawning facility," though the single-byte overflow is still possible without KDC TCP support enabled.

Symantec's Norton 360 faces delay
As Microsoft rolls out its long-awaited Windows OneCare Live software, the security industry's antivirus giants are also preparing their own challenges. However, Symantec's initiative has reportedly hit a stumbling block.

According to a report from CNET News.com, Symantec's Norton 360 software, which is being designed to compete with OneCare's combination of antivirus, antispyware and firewall capabilities, is now expected to ship in March 2007, instead of September 2006.

Symantec said Norton 360, previously known by its codename Genesis, may ship sooner, depending in part on the results of a sizable public beta beginning next month. Other product details have yet to be announced.

Microsoft's OneCare product debuts today at $49.99 a year for up to three PCs per home. It also includes tune-up tools and other backup features for Windows PCs. Santa Clara, Calif.-based McAfee Inc. is also preparing a rival product, dubbed Falcon, that will be available this summer. Falcon will offer features in its current product line to defend desktops against spyware, viruses, spam, phishing and rootkits, and will feature an overhauled management interface.

Tags: Open Source Security Tools and Applications,  Network Intrusion Detection (IDS),  Malware, Viruses, Trojans and Spyware,  Network Protocols and Security,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Open Source Security Tools and Applications Screencasts: On-screen demonstrations of security tools PuTTY configuration tips: How to connect to remote network systems Screencast: Find rogue wireless access points with Vistumbler H.D. Moore on future of Metasploit attack platform H.D. Moore speaks about Metasploit Project deal, Release 3.3 Screencast: How to launch an OpenVAS scan Could Metasploit popularity erode? Metasploit Project acquired by vulnerability management firm Rapid7 SSH key compromise shuts down Apache website Screencast: Smoothwall offers firewall defense in lean times Network Intrusion Detection (IDS) Scapy tutorial: How to use Scapy to test Snort rules White House declassifies CNCI summary, lifts veil on security initiatives Preventing SQL injection attacks: A network admin's perspective Lifecycle of a network security vulnerability Best Intrusion Prevention and Detection Products Rogue AP containment methods SIMs tools and tactics for business intelligence IPS and IDS deployment strategies Know when you need IDS, IPS or both Trend Micro to acquire Third Brigade for virtualization, cloud security Network Intrusion Detection (IDS) Research Malware, Viruses, Trojans and Spyware Major ISPs can remove botnets, malware, CISO says Zeus botnet temporarily disrupted, but back in full force Botnets, malware and capturing cybercriminals Botnets, malware and capturing cybercriminals Social networking threats put new pressure on healthcare CSOs Zeus Trojan continues reign infecting 74,000 PCs in global botnet Defending against RAM scraper malware in the enterprise Malware in Google attacks uses spaghetti code Preparing for future security threats, evolving malware Facebook attacks prompt investments in social networking security

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary Blowfish  (SearchSecurity.com) Kermit  (SearchSecurity.com) Open Source Hardening Project  (SearchSecurity.com) SnortSnarf  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary