Snort 1.6, when running in straight ASCII packet logging mode or IDS mode with straight decoded ASCII packet logging selected, allows remote attackers to cause a denial of service (crash) by sending non-IP protocols that Snort does not know about, as demonstrated by an nmap protocol scan.
Snort 1.6 is vulnerable to a denial-of-service (DoS) attack. By sending crafted network packets using unknown protocols, attackers can crash the Snort process, rendering it unable to monitor network traffic and potentially allowing malicious activity to go undetected. This vulnerability can be triggered remotely, impacting network security and availability.
Step 1: Packet Crafting: The attacker crafts network packets using protocols that Snort 1.6 does not natively support or recognize. This could involve using a protocol not defined in Snort's configuration or sending packets with malformed headers or payloads that trigger unexpected behavior.
Step 2: Packet Transmission: The attacker sends these crafted packets to a network monitored by a Snort 1.6 instance configured in straight ASCII packet logging mode or IDS mode with straight decoded ASCII packet logging selected.
Step 3: Snort Processing: Snort receives the packets and attempts to decode them. Due to the unknown protocol, the decoding process encounters an error or an unhandled condition.
Step 4: Crash/DoS: The error condition leads to a crash of the Snort process, resulting in a denial of service. Snort stops monitoring network traffic, leaving the network vulnerable.
The vulnerability lies within Snort 1.6's handling of unknown or unsupported network protocols when operating in ASCII packet logging or IDS mode with ASCII logging enabled. The root cause is likely an unhandled exception or error condition within the packet decoding logic. When Snort encounters a protocol it doesn't recognize, it attempts to process it, likely leading to a crash due to an invalid memory access or an unexpected state. Specifically, the code likely lacks proper input validation or error handling for these unknown protocols, leading to a null pointer dereference, buffer overflow, or other memory corruption issues. The lack of robust error handling allows a malformed packet to trigger a crash, resulting in a DoS.