Package: snort
Version: 2.8.5.2-8
Severity: normal
If we make this:
#preprocessor arpspoof
preprocessor arpspoof_detect_host: 192.168.1.1 AA:AA:AA:AA:AA:AA
On the snort's conf file (/etc/snort/snort.conf), it'll result in a
Segmentation Fault.
"Starting Network Intrusion Detection System : snort (eth0 using
/etc/snort/snort.confSegmentation fault
...ERROR: failed (check /var/log/daemon.log, /var/log/syslog and
/var/log/snort/)) failed!"
Cause we're moving 0 to %rax here:
44ccdf: 48 8b 05 9a d1 9d 00 mov 0x9dd19a(%rip),%rax #
e29e80 <stdout+0x768a00>
And trying to move 0 to the adress of %rax at that moment:
44ccef: 89 10 mov %edx,(%rax)
The segfault, occur at $0x44ccef.
-- System Information:
Debian Release: 6.0.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/dash
Versions of packages snort depends on:
ii adduser 3.112+nmu2 add and remove users and groups
ii debconf [debconf-2.0] 1.5.36.1 Debian configuration management sy
ii libc6 2.11.3-4 Embedded GNU C Library: Shared lib
ii libgcrypt11 1.4.5-2 LGPL Crypto library - runtime libr
ii libgnutls26 2.8.6-1+squeeze2 the GNU TLS library - runtime libr
ii libltdl7 2.2.6b-2 A system independent dlopen wrappe
ii libpcap0.8 1.1.1-2+squeeze1 system interface for user-level pa
ii libpcre3 8.02-1.1 Perl 5 Compatible Regular Expressi
ii libprelude2 1.0.0-1 Security Information Management Sy
ii logrotate 3.7.8-6 Log rotation utility
ii rsyslog [system-log-dae 4.6.4-2 enhanced multi-threaded syslogd
ii snort-common 2.8.5.2-8 flexible Network Intrusion Detecti
ii snort-common-libraries 2.8.5.2-8 flexible Network Intrusion Detecti
ii snort-rules-default 2.8.5.2-8 flexible Network Intrusion Detecti
Versions of packages snort recommends:
ii iproute 20100519-3 networking and traffic control too
Versions of packages snort suggests:
pn snort-doc <none> (no description available)
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
