Snort vuln - update available

FYI…

- http://www.snort.org/docs/advisory-2007-02-19.html
2007-02-19
"Summary: Sourcefire has learned of a remotely exploitable vulnerability in the Snort DCE/RPC preprocessor. This preprocessor is vulnerable to a stack-based buffer overflow that could potentially allow attackers to execute code with the same privileges as the Snort binary. Sourcefire has prepared updates for Snort open-source software to address this…
Snort Versions Affected:
* Snort 2.6.1, [removed], and [removed]
* Snort 2.7.0 beta 1
This vulnerability also affects Sourcefire commercial products. For information and updates for Sourcefire products, please go to the Sourcefire support site.
Mitigating Factors:
Users who have disabled the DCE/RPC preprocessor are not vulnerable. However, the DCE/RPC preprocessor is enabled by default.
Recommended Actions:
* Open-source Snort 2.6.1.x users are advised to upgrade to Snort 2.6.1.3* (or later) immediately.
* Open-source Snort 2.7 beta users are advised to mitigate this issue by disabling the DCE/RPC preprocessor. This issue will be resolved in Snort 2.7 beta 2…"

* http://www.snort.org/dl/

Release notes:
http://www.snort.org/docs/release_notes/re…_notes_2613.txt

.

More…

- http://www.us-cert.gov/current/#snrtfrgpkt
February 19, 2007 ~ "…By sending a specially crafted TCP packet, a remote attacker could execute arbitrary code with privileges of the Snort process…
More information about this vulnerability is located in the following:
* Vulnerability Note VU#196240* - Sourcefire Snort DCE/RPC preprocessor does not properly reassemble fragmented packets…"

* http://www.kb.cert.org/vuls/id/196240