[Snort-users] [greg.morris@sourcefire.com: Snort Mitigation and Patch Notification]

A sales representative at Sourcefire, whom I asked some months ago to cease contacting me, today sent me unsolicited commercial email (spam). The odd thing about this spam is that it alleged an (as yet) undisclosed vulnerability in Snort's RPC decoding routines. Is it conventional for vendor sales representatives to use undisclosed vulnerability notices as a "teaser" in unsolicited commercial email? This strikes me as rather problematic. Thoughts?

(Why pass this along ahead of the listed 1PM EST timeline? I don't like being spammed.)

• Forwarded message from Greg Morris <greg.morris@sourcefire.com> ----- From: "Greg Morris" <greg.morris@sourcefire.com> To: kkrueger@whoi.edu Subject: Snort Mitigation and Patch Notification Organization: Sourcefire

   Karl,

   Wanted to give you a heads up about an incident we discovered. It    involves Snort. While we are only notifying our Sourcefire customers    initially, I thought it important to notify you, since I know you run    Snort. Call me to discuss (XXX) XXX-XXXX. The mitigation for SNORT only    (non-Sourcefire user) is at the bottom of this email.

   Greg

   Subject: Sourcefire IMS Mitigation and Patch Notification

   Sourcefire would like to give our customers and partners notification that    the Sourcefire Vulnerability Research Team has learned of a vulnerability    in the Sourcefire Network Sensor product line. A full advisory and    instructions for downloading a patch will be sent out at 1:00PM EST this    afternoon.

[REDACTED]
   Mitigation:

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related snort.org Links snort-announce snort-cvsinfo snort-devel snort-sigs snort-users Request more information about Pantek

   Disabling the RPC preprocessor will make the Sourcefire Network Sensor    invulnerable to the attack.

[REDACTED]
   The mitigation instructions for Snort sensors are as follows:

   comment out the line in your snort.conf that begins:

       preprocessor rpc_decode

   and replace it with

       # preprocessor rpc_decode

   Greg Morris
   Sourcefire Network Security
   Director, Northeast Region Sales
   Mobile - (516) 769-2298
   www.sourcefire.com

• End forwarded message -----

-- 
Karl A. Krueger 
Network Security -- Linux/Unix Systems Support -- Etc.
Woods Hole Oceanographic Institution



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users