Summary
Cisco heeft meerdere kwetsbaarheden verholpen in Snort 3, het open source intrusion detection en prevention systeem dat in diverse Cisco-producten wordt gebruikt.
Details
Interpretaties
De kwetsbaarheden bevinden zich in verschillende componenten van de Snort 3 Detection Engine, waaronder de SMTP MIME Decoder, NetFlow Detection Engine, GRE Detection Engine, Teredo Detection Engine, VBA Decompression Engine, en de memory management. Ongeauthenticeerde remote aanvallers kunnen speciaal vervaardigde pakketten of datagrammen versturen die leiden tot onverwachte herstarts van de detectie-engine, wat resulteert in een denial of service. Daarnaast is er een kwetsbaarheid in de control channel socket die een geauthenticeerde lokale aanvaller met lage privileges in staat stelt om arbitrary commands uit te voeren en toegang te krijgen tot het geheugen van het Snort 3 proces. De kwetsbaarheden beïnvloeden de stabiliteit, betrouwbaarheid en continuïteit van netwerkverkeersinspectie en dreigingsdetectie binnen de getroffen Cisco-producten.
Oplossingen
Cisco heeft updates en software hardening releases uitgebracht om deze kwetsbaarheden in Snort 3 te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 13
-
Critical 9.0
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add…
-
High 7.8
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add…
-
High 7.8
Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability
A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authent…
-
High 7.5
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add…
-
High 7.5
Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add…
-
Medium 5.8
Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a lack of error checking when the MIME…
-
Medium 5.8
Multiple Cisco Products Snort 3 Netflow Denial of Service Vulnerabilities
Multiple Cisco products are affected by a vulnerability in the Snort 3 NetFlow Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vuln…
-
Medium 5.8
Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities
Multiple Cisco products are affected by a vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of …
-
Medium 5.8
Multiple Cisco Products Snort 3 Teredo Protocol Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 Teredo Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulne…
-
Medium 5.8
Cisco Secure Firewall Threat Defense Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service …
-
Medium 5.8
Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities
Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 …
-
Medium 5.8
Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection…
-
Medium 5.3
Multiple Cisco Products Snort 3 Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulnerabi…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-opensrc-snort3-2fXGJPfe
-
Reference
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gre-JNpMHrTv
-
Reference
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-Rmecfepz
-
Reference
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKkt
-
Reference
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK
-
Reference
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-vba-bufdos-jAuFdvn9