Sourcefire, which oversees the open-source intrusion-detection system Snort and makes commercial products based on it, Tuesday disclosed a major vulnerability in Snort along with corrective measures to mitigate the risk.

Snort versions 2.4.0 and higher are subject to a buffer-overflow vulnerability that would let an attacker execute code remotely on a Snort sensor when the Back Orifice preprocessor is running, resulting in complete compromise of Snort. The Back Orifice preprocessor is the Snort functionality for detecting any activity associated with the malicious back-door code Back Orifice.

Jennifer Steffens, Sourcefire’s director of product management, said there are two ways Sourcefire is advising Snort users and Sourcefire customers to eliminate the problem. Details about the vulnerability and mitigation instructions from Sourcefire are here. 

Sourcefire is urging users to install an updated version of Snort released Tuesday, Snort v. 2.4.3, to correct the problem. If it’s not feasible for Snort users or Sourcefire customers to immediately update the new version that corrects the buffer-overflow vulnerability, then they should consider disabling the Back Orifice preprocessor function. “But then they wouldn’t be able to detect Back Orifice activity,” Steffens added.

The flaw associated with Snort’s Back Orifice preprocessor is only the second major vulnerability to be discovered in Snort for the past two years, she added.

The Snort vulnerability was first uncovered by Internet Security Systems (ISS), which reported it directly to US-CERT, which transmitted the information to Sourcefire. Snort information from US-CERT can be found here.

Steffens said Sourcefire heard about it on Oct. 13 and spent the weekend testing for it and coming up with a fix. There are an undisclosed number of Sourcefire customers and about 100,000 users of open-source Snort.

Neel Mehta, team lead at the ISS X-Force research and development division, which investigates security weaknesses throughout a wide variety of vendor products, said ISS discovered the Snort vulnerability while doing routine testing.

“It’s trivial to exploit,” Mehta claims. “Anyone who does vulnerability testing can do this. It’s a buffer overflow that is triggered with a single UDP packet. It would make it easy for worms to exploit this.”