[Snort-users] Attack on snort running in Public Zone

Craig Paterson craigp at ...9278...
Tue Nov 18 16:54:30 EST 2003


Matt Kettler wrote:

> At 04:35 PM 11/18/2003, bmcdowell at ...7861... wrote:
>
>> It seems to me that, second interface or not, such an exploit as the
>> example Matt gave could also be used to somehow provide an IP to the
>> 'stealth' box.
>>
>> Now a tap, well, they would need to do some wiring to beat that one
>> (unless there's another interface).  Right?
>
>
> In a box with only one NIC, connected to a hardware tap with no send 
> capabilities, even the best case for an exploiter would leave them 
> limited to making changes to the snort box itself.. ie: they could 
> load code to delete files, call for shutdown, etc.
>
> So it's still not hackproof, but you've greatly limited what they can do.
>
> Realistically they'd also be limited in the size of the code they 
> could execute by the nature of the buffer overflow in snort they were 
> exploiting.. I've never studied the old 1.9.x stream4 exploit to get 
> an idea of roughly how much code could be executed with it.
>
> However, they'd never be able to get any kind of remote shell, or get 
> any data out of the snort box to do much useful.
>
> Of course, your only way of getting a prompt or data out of the box 
> would be at the physical console itself. You'd not be able to get a 
> remote login shell, etc, either. 


It's getting a little elaborate, but you have the (hypothetical) second, 
management interface on a DMZ and the sniffing interface on a tap. That 
way you have free access to the Snort box without having to wander up to 
it, but it has limited or no access to your internal net.

Of course if that's too much of a pain just put the management interface 
on your LAN and disallow all internet-bound traffic from that interface 
at the firewall. Someone could still compromise the Snort box through an 
(also hypothetical) attack via the sensor, and could cause traffic to be 
sent out on your LAN. But they'd be doing it all blind, and it'd be at 
least very tricky to do anything too particular. So it might provide 
security you think adequate.

Craig.





More information about the Snort-users mailing list