PT-2007-2792 · Cisco · Snort

Antimatt3R · Published 2007-03-10 · Updated 2017-10-11 · CVE-2007-1398

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Snort versions 2.6.1.1 through 2.6.1.2 Snort version 2.7.0 beta

Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault and application crash, via certain UDP packets. This occurs when the frag3 preprocessor in Snort is configured for inline use on Linux without the ip conntrack module loaded.

Recommendations For Snort versions 2.6.1.1 and 2.6.1.2, consider loading the ip conntrack module to prevent the denial of service. For Snort version 2.7.0 beta, consider loading the ip conntrack module to prevent the denial of service. As a temporary workaround, consider disabling the frag3 preprocessor until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2007-1398

Affected Products

Snort

References · 5

• 🔥 https://exploit-db.com/exploits/3434 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1398 · Security Note
• http://snort.org/docs/release_notes/release_notes_2613.txt · Note
• http://securityfocus.com/bid/22872 · Note
• http://osvdb.org/33024 · Note