Your message dated Sat, 21 Feb 2009 12:02:17 +0000
with message-id <[email protected]>
and subject line Bug#503992: fixed in snort 2.8.1-3
has caused the Debian Bug report #503992,
regarding snort: Segfaults some time after startup, suspect some packet
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
503992: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503992
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: snort
Version: 2.7.0-20
Severity: important
Snort segfaults some time after startup, as witnessed by syslog:
Oct 30 07:58:30 treize kernel: [2835892.216074] snort[7047]: segfault at c ip
b7b66443 sp bf90d57c error 4 in libc-2.7.so[b7af0000+155000]
Oct 30 09:51:54 treize kernel: [2842695.784249] snort[13280]: segfault at 69 ip
b7c2c41b sp bfed249c error 4 in libc-2.7.so[b7bb6000+155000]
I attached a gdb to my snort instance on eth0 (internet), it segfaulted
after about 5 minutes.
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7b288c0 (LWP 14885)]
0xb7b9f443 in strlen () from /lib/i686/cmov/libc.so.6
(gdb) bt
#0 0xb7b9f443 in strlen () from /lib/i686/cmov/libc.so.6
#1 0xb7b6c1ac in vfprintf () from /lib/i686/cmov/libc.so.6
#2 0xb7b903b4 in vsnprintf () from /lib/i686/cmov/libc.so.6
#3 0x08063194 in ?? ()
#4 0xbfa44213 in ?? ()
#5 0x00000400 in ?? ()
#6 0x080d0070 in ?? ()
#7 0xbfa44624 in ?? ()
#8 0x00000000 in ?? ()
This type of segfaults has seemed to happen quite regularly since
october 27th. It looks like it happens more often when processing
bittorrent traffic.
I upgraded snort on october 23th:
[UPGRADE] snort 2.7.0-19 -> 2.7.0-20
[UPGRADE] snort-common 2.7.0-19 -> 2.7.0-20
[UPGRADE] snort-common-libraries 2.7.0-19 -> 2.7.0-20
[UPGRADE] snort-rules-default 2.7.0-19 -> 2.7.0-20
I don't remember this happening before.
I have no pcap trace.
I can search the logs, but I don't know what to look for. I can
investigate more if needed.
Thanks a lot for your help.
-- System Information:
Debian Release: lenny/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.26-1-686 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages snort depends on:
ii adduser 3.110 add and remove users and groups
ii debconf [debconf-2.0] 1.5.24 Debian configuration management sy
ii libc6 2.7-15 GNU C Library: Shared libraries
ii libgcrypt11 1.4.1-1 LGPL Crypto library - runtime libr
ii libgnutls26 2.4.2-1 the GNU TLS library - runtime libr
ii libgpg-error0 1.4-2 library for common error values an
ii libltdl3 1.5.26-4 A system independent dlopen wrappe
ii libpcap0.8 0.9.8-5 system interface for user-level pa
ii libpcre3 7.8-2 Perl 5 Compatible Regular Expressi
ii libprelude2 0.9.18.1-1 Hybrid Intrusion Detection System
ii libtasn1-3 1.5-1 Manage ASN.1 structures (runtime)
ii logrotate 3.7.1-5 Log rotation utility
ii snort-common 2.7.0-20 flexible Network Intrusion Detecti
ii snort-common-libraries 2.7.0-20 flexible Network Intrusion Detecti
ii snort-rules-default 2.7.0-20 flexible Network Intrusion Detecti
ii sysklogd [system-log-d 1.5-5 System Logging Daemon
ii zlib1g 1:1.2.3.3.dfsg-12 compression library - runtime
Versions of packages snort recommends:
ii iproute 20080725-2 networking and traffic control too
Versions of packages snort suggests:
pn snort-doc <none> (no description available)
-- debconf information:
* snort/startup: boot
snort/please_restart_manually:
* snort/stats_treshold: 1
* snort/address_range: any
* snort/options:
snort/invalid_interface:
* snort/interface: eth0 eth1
* snort/stats_rcpt: root
* snort/send_stats: true
snort/config_parameters:
* snort/config_error:
* snort/reverse_order: false
* snort/disable_promiscuous: false
--- End Message ---
--- Begin Message ---
Source: snort
Source-Version: 2.8.1-3
We believe that the bug you reported is fixed in the latest version of
snort, which is due to be installed in the Debian FTP archive:
snort-common-libraries_2.8.1-3_i386.deb
to pool/main/s/snort/snort-common-libraries_2.8.1-3_i386.deb
snort-common_2.8.1-3_all.deb
to pool/main/s/snort/snort-common_2.8.1-3_all.deb
snort-doc_2.8.1-3_all.deb
to pool/main/s/snort/snort-doc_2.8.1-3_all.deb
snort-mysql_2.8.1-3_i386.deb
to pool/main/s/snort/snort-mysql_2.8.1-3_i386.deb
snort-pgsql_2.8.1-3_i386.deb
to pool/main/s/snort/snort-pgsql_2.8.1-3_i386.deb
snort-rules-default_2.8.1-3_all.deb
to pool/main/s/snort/snort-rules-default_2.8.1-3_all.deb
snort_2.8.1-3.diff.gz
to pool/main/s/snort/snort_2.8.1-3.diff.gz
snort_2.8.1-3.dsc
to pool/main/s/snort/snort_2.8.1-3.dsc
snort_2.8.1-3_i386.deb
to pool/main/s/snort/snort_2.8.1-3_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Javier Fernandez-Sanguino Pen~a <[email protected]> (supplier of updated snort
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sat, 21 Feb 2009 12:41:01 +0100
Source: snort
Binary: snort snort-common snort-doc snort-mysql snort-pgsql
snort-rules-default snort-common-libraries
Architecture: source i386 all
Version: 2.8.1-3
Distribution: experimental
Urgency: low
Maintainer: Javier Fernandez-Sanguino Pen~a <[email protected]>
Changed-By: Javier Fernandez-Sanguino Pen~a <[email protected]>
Description:
snort - flexible Network Intrusion Detection System
snort-common - flexible Network Intrusion Detection System [common files]
snort-common-libraries - flexible Network Intrusion Detection System ruleset
snort-doc - Documentation for the Snort IDS [documentation]
snort-mysql - flexible Network Intrusion Detection System [MySQL]
snort-pgsql - flexible Network Intrusion Detection System [PostgreSQL]
snort-rules-default - flexible Network Intrusion Detection System ruleset
Closes: 503992
Changes:
snort (2.8.1-3) experimental; urgency=low
.
* Fix error in call to LogMessage (missing parameters) which caused a
segfault
when fragmented packages were received and ttl_limit was set (Closes:
#503992)
Checksums-Sha1:
13a982933299cfdddeaf5ba61dd7a591c57b1bcb 1388 snort_2.8.1-3.dsc
8f37d68fb87978b000fa80d015cfb5718dc954c4 1602461 snort_2.8.1-3.diff.gz
02a6ee07ef9aff3bbece245c75136d3cfcf16e49 521698 snort_2.8.1-3_i386.deb
fc327884504ca386a62b1f68542f8958d4b236ae 530570 snort-mysql_2.8.1-3_i386.deb
5207a52294e2fd3d7a6d0dce9723d5b84dc10c12 530316 snort-pgsql_2.8.1-3_i386.deb
68e1bc75e43f6207f077856a0f4a20cac9ba8cff 309234
snort-common-libraries_2.8.1-3_i386.deb
6f81f038cd2f7c775f50148e8a66d83321349ac1 155692 snort-common_2.8.1-3_all.deb
d2e05d7889f10f8b0b4f2b370e7e624d196e24ac 2395046 snort-doc_2.8.1-3_all.deb
c3cdd8a8ffed3bb8fae9a02a1eff0ee55c91dfa4 428676
snort-rules-default_2.8.1-3_all.deb
Checksums-Sha256:
5f90e8b2f7f0666e0fb6189a91a9ce11bb8ee289aa52828a3f61f8ee126b29da 1388
snort_2.8.1-3.dsc
b922601e135afc63ea67be3df1b97b94bb2304c8ffe75ca78783627c2d22d344 1602461
snort_2.8.1-3.diff.gz
3b16d7e99b8177ad0995afc7ed372f0595aacef5d21d56b47d699615ec5928cf 521698
snort_2.8.1-3_i386.deb
621600143ded037d700f63058e0244eb4e53a28419fa64917c5c5838ffaf867f 530570
snort-mysql_2.8.1-3_i386.deb
4462708739e1139a2cb291853fd2b9d45c3cda641d30ba159ed09596c57a90c7 530316
snort-pgsql_2.8.1-3_i386.deb
654fa194e340c1b409cefaad8edcb371d8e14fdc049012cb5f79eba65a6f12a0 309234
snort-common-libraries_2.8.1-3_i386.deb
94ba25ad73aadffeef28c60b71abb24794e156fca6bc106207878ffbf5abfce0 155692
snort-common_2.8.1-3_all.deb
052379902d18146e358923d679dff89a666219b906bbf7a985399ac989d99804 2395046
snort-doc_2.8.1-3_all.deb
72ca06f7d3f461866c80e5b63785eaf4b224e5f261240465b868e315999649bc 428676
snort-rules-default_2.8.1-3_all.deb
Files:
39f474996bce0b771702848fe65962df 1388 net optional snort_2.8.1-3.dsc
db07b94b50b063625eff5f09a81d2151 1602461 net optional snort_2.8.1-3.diff.gz
2f163bfe1c1d9af3fe4a74dab4b5394f 521698 net optional snort_2.8.1-3_i386.deb
9e40b3e9ec67a0874e7eca19824e25d2 530570 net extra snort-mysql_2.8.1-3_i386.deb
1c356b17dd49ce552f9c43d43bd7fbb6 530316 net optional
snort-pgsql_2.8.1-3_i386.deb
3542690939fc5e85b31a4ecc6e1949ea 309234 net optional
snort-common-libraries_2.8.1-3_i386.deb
28408deea24762125d783c1f8157311e 155692 net optional
snort-common_2.8.1-3_all.deb
3540dd804260acf1452777120b76b287 2395046 doc optional snort-doc_2.8.1-3_all.deb
9a1c0770bf4d05aa131dc0b6d0effd00 428676 net optional
snort-rules-default_2.8.1-3_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJn+qusandgtyBSwkRAsjXAKCGeNsgumHSKgXC0KbdwbgqBfuiFQCeLRdk
qlZvG0LmIN0vt/XVW9ahc2o=
=m05N
-----END PGP SIGNATURE-----
--- End Message ---
