Description
Multiple Cisco products are affected by a vulnerability in the Snort application detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. The vulnerability is due to a flaw in the detection algorithm. An attacker could exploit this vulnerability by sending crafted packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cisco | Cisco Firepower Threat Defense Software | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | snort | 2.9.20-0+deb11u1 | DSA-5354-1 |
| Debian 10 | snort | 2.9.20-0+deb10u1 | DLA-3317-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | snort | No fix yet | — |
| Ubuntu 18.04 LTS | snort | No fix yet | — |
| Ubuntu 16.04 LTS | snort | No fix yet | — |
| Ubuntu 14.04 LTS | snort | No fix yet | — |
Advisories 3
- DSA-5354-1 snort - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3317-1 snort - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-0339 Snort: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Feb 19, 2023
References
- 20210113 Multiple Cisco Products Snort Application Detection Engine Policy Bypass Vulnerability vendor-advisory
- [debian-lts-announce] 20230210 [SECURITY] [DLA 3317-1] snort security update mailing-list
- DSA-5354 vendor-advisory