Your message dated Sat, 21 Feb 2009 12:02:11 +0000
with message-id <[email protected]>
and subject line Bug#503992: fixed in snort 2.7.0-23
has caused the Debian Bug report #503992,
regarding snort: Segfaults some time after startup, suspect some packet
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
503992: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503992
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: snort
Version: 2.7.0-20
Severity: important
Snort segfaults some time after startup, as witnessed by syslog:
Oct 30 07:58:30 treize kernel: [2835892.216074] snort[7047]: segfault at c ip
b7b66443 sp bf90d57c error 4 in libc-2.7.so[b7af0000+155000]
Oct 30 09:51:54 treize kernel: [2842695.784249] snort[13280]: segfault at 69 ip
b7c2c41b sp bfed249c error 4 in libc-2.7.so[b7bb6000+155000]
I attached a gdb to my snort instance on eth0 (internet), it segfaulted
after about 5 minutes.
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7b288c0 (LWP 14885)]
0xb7b9f443 in strlen () from /lib/i686/cmov/libc.so.6
(gdb) bt
#0 0xb7b9f443 in strlen () from /lib/i686/cmov/libc.so.6
#1 0xb7b6c1ac in vfprintf () from /lib/i686/cmov/libc.so.6
#2 0xb7b903b4 in vsnprintf () from /lib/i686/cmov/libc.so.6
#3 0x08063194 in ?? ()
#4 0xbfa44213 in ?? ()
#5 0x00000400 in ?? ()
#6 0x080d0070 in ?? ()
#7 0xbfa44624 in ?? ()
#8 0x00000000 in ?? ()
This type of segfaults has seemed to happen quite regularly since
october 27th. It looks like it happens more often when processing
bittorrent traffic.
I upgraded snort on october 23th:
[UPGRADE] snort 2.7.0-19 -> 2.7.0-20
[UPGRADE] snort-common 2.7.0-19 -> 2.7.0-20
[UPGRADE] snort-common-libraries 2.7.0-19 -> 2.7.0-20
[UPGRADE] snort-rules-default 2.7.0-19 -> 2.7.0-20
I don't remember this happening before.
I have no pcap trace.
I can search the logs, but I don't know what to look for. I can
investigate more if needed.
Thanks a lot for your help.
-- System Information:
Debian Release: lenny/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.26-1-686 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages snort depends on:
ii adduser 3.110 add and remove users and groups
ii debconf [debconf-2.0] 1.5.24 Debian configuration management sy
ii libc6 2.7-15 GNU C Library: Shared libraries
ii libgcrypt11 1.4.1-1 LGPL Crypto library - runtime libr
ii libgnutls26 2.4.2-1 the GNU TLS library - runtime libr
ii libgpg-error0 1.4-2 library for common error values an
ii libltdl3 1.5.26-4 A system independent dlopen wrappe
ii libpcap0.8 0.9.8-5 system interface for user-level pa
ii libpcre3 7.8-2 Perl 5 Compatible Regular Expressi
ii libprelude2 0.9.18.1-1 Hybrid Intrusion Detection System
ii libtasn1-3 1.5-1 Manage ASN.1 structures (runtime)
ii logrotate 3.7.1-5 Log rotation utility
ii snort-common 2.7.0-20 flexible Network Intrusion Detecti
ii snort-common-libraries 2.7.0-20 flexible Network Intrusion Detecti
ii snort-rules-default 2.7.0-20 flexible Network Intrusion Detecti
ii sysklogd [system-log-d 1.5-5 System Logging Daemon
ii zlib1g 1:1.2.3.3.dfsg-12 compression library - runtime
Versions of packages snort recommends:
ii iproute 20080725-2 networking and traffic control too
Versions of packages snort suggests:
pn snort-doc <none> (no description available)
-- debconf information:
* snort/startup: boot
snort/please_restart_manually:
* snort/stats_treshold: 1
* snort/address_range: any
* snort/options:
snort/invalid_interface:
* snort/interface: eth0 eth1
* snort/stats_rcpt: root
* snort/send_stats: true
snort/config_parameters:
* snort/config_error:
* snort/reverse_order: false
* snort/disable_promiscuous: false
--- End Message ---
--- Begin Message ---
Source: snort
Source-Version: 2.7.0-23
We believe that the bug you reported is fixed in the latest version of
snort, which is due to be installed in the Debian FTP archive:
snort-common-libraries_2.7.0-23_i386.deb
to pool/main/s/snort/snort-common-libraries_2.7.0-23_i386.deb
snort-common_2.7.0-23_all.deb
to pool/main/s/snort/snort-common_2.7.0-23_all.deb
snort-doc_2.7.0-23_all.deb
to pool/main/s/snort/snort-doc_2.7.0-23_all.deb
snort-mysql_2.7.0-23_i386.deb
to pool/main/s/snort/snort-mysql_2.7.0-23_i386.deb
snort-pgsql_2.7.0-23_i386.deb
to pool/main/s/snort/snort-pgsql_2.7.0-23_i386.deb
snort-rules-default_2.7.0-23_all.deb
to pool/main/s/snort/snort-rules-default_2.7.0-23_all.deb
snort_2.7.0-23.diff.gz
to pool/main/s/snort/snort_2.7.0-23.diff.gz
snort_2.7.0-23.dsc
to pool/main/s/snort/snort_2.7.0-23.dsc
snort_2.7.0-23_i386.deb
to pool/main/s/snort/snort_2.7.0-23_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Javier Fernandez-Sanguino Pen~a <[email protected]> (supplier of updated snort
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sat, 21 Feb 2009 12:11:33 +0100
Source: snort
Binary: snort snort-common snort-doc snort-mysql snort-pgsql
snort-rules-default snort-common-libraries
Architecture: source i386 all
Version: 2.7.0-23
Distribution: unstable
Urgency: high
Maintainer: Javier Fernandez-Sanguino Pen~a <[email protected]>
Changed-By: Javier Fernandez-Sanguino Pen~a <[email protected]>
Description:
snort - flexible Network Intrusion Detection System
snort-common - flexible Network Intrusion Detection System [common files]
snort-common-libraries - flexible Network Intrusion Detection System ruleset
snort-doc - Documentation for the Snort IDS [documentation]
snort-mysql - flexible Network Intrusion Detection System [MySQL]
snort-pgsql - flexible Network Intrusion Detection System [PostgreSQL]
snort-rules-default - flexible Network Intrusion Detection System ruleset
Closes: 503992
Changes:
snort (2.7.0-23) unstable; urgency=high
.
* Fix error in call to LogMessage (missing parameters) which caused a
segfault
when fragmented packages were received and ttl_limit was set (Closes:
503992)
Checksums-Sha1:
4dd7ea74f0a53408c7f109b790517ba50d9d8877 1392 snort_2.7.0-23.dsc
ca3ce7b161acc4102e2874ee037c399fe4da8393 1600458 snort_2.7.0-23.diff.gz
bae83111fcc56450dacd3aa3236ced45b069c282 463852 snort_2.7.0-23_i386.deb
092ac725d82508cec8703eebcfa5c06e479b8948 474696 snort-mysql_2.7.0-23_i386.deb
1c5d335aa897a57c1dd754ef36726aa55ffa065d 474526 snort-pgsql_2.7.0-23_i386.deb
1a1f2dfffe06f6dced7cd4c1c9edc02c04b06f1a 244826
snort-common-libraries_2.7.0-23_i386.deb
f3ea78376b535ece17a9324cc9e6faf3db7fb4aa 147648 snort-common_2.7.0-23_all.deb
987847d5ce8166a06a90ea34ecd0a4215e9a43d2 2304026 snort-doc_2.7.0-23_all.deb
da644e85757e8094356e13afc4e2649cce2f2f3d 402476
snort-rules-default_2.7.0-23_all.deb
Checksums-Sha256:
ee384d2ee05d7a70528465c1c1bd93d555fea0f3239dd9f0049cca4b26c17f68 1392
snort_2.7.0-23.dsc
ef1ce9b9d518677875ac7c12bd250f512ca1b1aa9f0973a460bfe635a5a1dbfe 1600458
snort_2.7.0-23.diff.gz
66cd6b06581c101afa65a19a4f3d03779cfdf13224f52acd74755b3e9baf9ff8 463852
snort_2.7.0-23_i386.deb
996bb8785c546a607798c5403771d8d6578d6cc9dc407a5fde84516bf14532b8 474696
snort-mysql_2.7.0-23_i386.deb
b32d7d49b4b74dc44c4021ff4bb3beac893aff8be8d8a2d96e658722a3382880 474526
snort-pgsql_2.7.0-23_i386.deb
d0475c32e7256fb8c4b399184d49d8db6aa918bddcca5144293fe3a7dd62b7a6 244826
snort-common-libraries_2.7.0-23_i386.deb
21d3e649422c402e0b07a96e33370283a4635ac49fa4217221d2fcbb2cacdbfa 147648
snort-common_2.7.0-23_all.deb
ca07a91d3cddb0d2f310815ad11cb97493cbae72276d9e6c966572bf41d4a8af 2304026
snort-doc_2.7.0-23_all.deb
e48491dd99adc1e2a64eb71af48e2534f7c5c338c1fa657e1fa6e0586276a0f1 402476
snort-rules-default_2.7.0-23_all.deb
Files:
5e904521813c25873512cb0d1c80c092 1392 net optional snort_2.7.0-23.dsc
cbed9ef82920069aa4d2287b23d097ee 1600458 net optional snort_2.7.0-23.diff.gz
dde8feee915e96d981d94a582571480c 463852 net optional snort_2.7.0-23_i386.deb
573a28d01fbc0b2155ff489261321040 474696 net extra snort-mysql_2.7.0-23_i386.deb
84df0dcc61a3139a8037667e0aea4cab 474526 net optional
snort-pgsql_2.7.0-23_i386.deb
636aee0dae2ae16f8f5ed8f761ca9d02 244826 net optional
snort-common-libraries_2.7.0-23_i386.deb
e2be0425edaa5f03d5ffebef88b6bd16 147648 net optional
snort-common_2.7.0-23_all.deb
fc7b0277eb6a468213656af0f219b74e 2304026 doc optional
snort-doc_2.7.0-23_all.deb
cddf6201337973d70a03b606e2a3277d 402476 net optional
snort-rules-default_2.7.0-23_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJn+nUsandgtyBSwkRAsl9AKCBcfcjDlrnfkIkpk/Phz+NdlcfmACfQ4lp
gayRY6eKcHmAh0fRklk0vG8=
=KI7X
-----END PGP SIGNATURE-----
--- End Message ---
