Snort/Prelude Crash Issue

Hi,
 
We are running snort v2.4.4 with libprelude v0.9.7.1 on Solaris 5.8 and
experience consistent crashes when attempting to push some of the
"Bleeding Snort" events into prelude.
 
(gdb) bt
#0  0xfeeb3218 in strlen () from /usr/lib/libc.so.1
#1  0xfef06520 in _doprnt () from /usr/lib/libc.so.1
#2  0xfef08694 in vsnprintf () from /usr/lib/libc.so.1
#3  0xff12e9fc in prelude_string_vprintf (string=0x22b2084,
    fmt=0xaa578 "%s%s", ap=0xffbeefdc) at prelude-string.c:780
#4  0xff12ea94 in prelude_string_sprintf (string=0x0, fmt=0xaa578
"%s%s")
    at prelude-string.c:829
#5  0x00046cb8 in event_to_reference (event=0x5f2de0, class=0x22b1c18)
    at spo_alert_prelude.c:410
#6  0x00046d70 in snort_alert_prelude (p=0xffbef408,
    msg=0x5f3ad0 "BLEEDING-EDGE WinProxy Host port buffer overflow",
    data=0x283190, event=0x5f2904) at spo_alert_prelude.c:453
#7  0x000381b8 in CallAlertFuncs (p=0xffbef408,
    message=0x5f3ad0 "BLEEDING-EDGE WinProxy Host port buffer overflow",
    head=0x66aa88, event=0x5f2904) at detect.c:402
#8  0x00038fa4 in AlertAction (p=0xffbef408, otn=0x5f27b8,
event=0x5f2904)
    at detect.c:1495
 
...
 
The problem appears be related in how references are handled, which this
signature has a couple:
 
bleeding-exploit.rules:alert tcp $EXTERNAL_NET any -> $HOME_NET
$HTTP_PORTS (msg:"BLEEDING-EDGE WinProxy Host port buffer overflow";
flow:established,to_server; content:"Host\:"; nocase; within:500;
pcre:"/\nHost\:\s*[^\n\:]*\:[^\n]{7}/i"; within:500;
reference:cve,2005-4085;
reference:url,www.frsirt.com/english/advisories/2006/0065;
classtype:bad-unknown; sid:2002764; rev:1;)

bleeding-sid-msg.map:2002764 || BLEEDING-EDGE WinProxy Host port buffer
overflow || url,www.frsirt.com/english/advisories/2006/0065 ||
cve,2005-4085 
 

Please let me know if any additional info is necessary to further
isolate.
 
Thanks,
 
Don

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel