A vulnerability has been identified in Snort, which could be exploited by remote attackers to cause a denial of service. This issue is caused by an error when processing malformed IPv6 packets when the application is compiled with the "--enable-ipv6" option and is running in verbose mode (-v), which could allow remote attackers to crash an affected application, creating a denial of service condition.

Affected Products

Snort versions prior to 2.8.5.1

Solution

Upgrade to Snort version 2.8.5.1 :
http://www.snort.org/start/download

References

http://www.vupen.com/english/advisories/2009/3014
http://vrt-sourcefire.blogspot.com/2009/10/snort-2851-release.html
http://g-laurent.blogspot.com/2009/10/snort-285-ipv6-remote-denial-of-service.html

Credits

Vulnerability reported by Laurent Gaffié.

Changelog

2009-10-23 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.