IPv6 support disabled

Bug #703707 reported by Eimann
22
This bug affects 4 people
Affects Status Importance Assigned to Milestone
snort (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: snort

Description: Ubuntu 10.04.1 LTS
Release: 10.04

snort:
  Installed: 2.8.5.2-2build1
  Candidate: 2.8.5.2-2build1
  Version table:
 *** 2.8.5.2-2build1 0
        500 http://de.archive.ubuntu.com/ubuntu/ lucid/universe Packages
        100 /var/lib/dpkg/status

The command "snort --version" should indicate IPv6 support, but it does not:

# snort --version

   ,,_ -*> Snort! <*-
  o" )~ Version 2.8.5.2 (Build 121)
   '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
           Copyright (C) 1998-2009 Sourcefire, Inc., et al.
           Using PCRE version: 7.8 2008-09-05

In "Version 2.8.5.2 (Build 121)" the statement "IPv6" is missing, probably due to missing --enable-ipv6 statement during ./configure.
As IPv6 is already in use on many Ubuntu Server installations, it's quite obvious that not only services like web or smtp-daemons but also IDS should support IPv6.
Also the "Configuring snort" debconf does not say IPv6 is not supported, nor it's checking the entered IP address, thus failing the install when an IPv6 homenet is entered.

Related branches

CVE References

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (4.8 KiB)

This bug was fixed in the package snort - 2.9.2-3ubuntu1

---------------
snort (2.9.2-3ubuntu1) precise; urgency=low

  * Merge from Debian testing. (LP: #931454) Remaining changes:
    - debian/rules: use mysql_config to find libraries to fix FTBFS with
      multiarch libmysqlclient.
  * Dropped "Fixed typo in snort.8": patched upstream.

snort (2.9.2-3) unstable; urgency=low

  * Restore code from the 2.8.5.2-5 package onwards which was lost when
    the version of experimental was moved to the archive.
     - Now /var/lib/snort is created through package configuration, as
       it should have been
     - Remove md5sum files when purging (Closes: #657038)
  * debian/rules:
      - Enable IPv6 support which was optional in version 2.8 for the Snort
        binary package. This is not enabled for the database binary packages
        (snort-pgsql and snort-mysql) as the database schemas do not support
        IPv6. (Closes: #633064) (LP: #703707)
      - Include the quilt makefile and add dependencies in -stamp and
        clean targets
  * debian/snort.init.d:
      - Do not abort if the package is not configured to use a database but
        the db-pending-config semaphore is found. Remove it instead and
        continue. This can happen if a database-related package was installed,
        removed and then 'snort' is installed afterwards.
        (LP: #316878, #639755, #722488, #754230, #798608, #876615, #816634, #891904, #918250)
  * debian/snort-{mysql,pgsql}.postrm:
      - Remove the db-pending-config semaphore file when removing the package.
        This prevents errors with the snort.init.d logic if a database package
        is left unconfigured and then replaced with the snort (non-database)
        package.
  * debian/README-database.Debian: Indicate that database support will be
    deprecated in 2.9 and document that IPv6 is not supported either
  * debian/control:
     - Add Build-Depends on quilt
     - Add VCS entries
     - Put the complete maintainer's name in UTF-8
     - Change Uploaders, add Andrew Pollock and remove Pascal Hakim
     - Update Standards Version

snort (2.9.2-2) unstable; urgency=low

  * debian/control: Add net-tools to Depends: of snort, snort-mysql and
    snort-pgsql since 'ifconfig' is required for the configuration script
    to work. (Closes: #656445)
  * debian/snort{,-mysql,-psql}.postinst: Create the checksum directory if it
    does not exist right at the beginning since it might not be created.
    (Closes: #656445)

snort (2.9.2-1) unstable; urgency=low

  [ Andrew Pollock ]
  * New upstream release, upload to unstable
     - Fixes CVE-2009-3641: DoS while printing specially-crafted IPv6 packet
       using the -v option (Closes: 553584)
     - The package no longer build-depends on iptables-dev and the negated list
       of architectures is no longer used (Closes: 634660)
     - debian/patches/config: Patch the configuration file to remove include
       files not currently available (Closes: #619446)
     - This version is fully supported rule-wise (LP: #872582)
  * Switch to dpkg-source 3.0 (quilt) format
  * Port across all changes from Snort 2.8.5.2-5 and later in unstable
  * debi...

Read more...

Changed in snort (Ubuntu):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.