Skip to content
OpenAdvisories
Medium · 4.0 CVE-2021-1236 EUVD-2021-6703GHSA-hj38-j9jq-rjpp

Multiple Cisco Products Snort Application Detection Engine Policy Bypass Vulnerability

Published Jan 13, 2021 · Updated Nov 12, 2024 · Assigned by cisco

Description

Multiple Cisco products are affected by a vulnerability in the Snort application detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. The vulnerability is due to a flaw in the detection algorithm. An attacker could exploit this vulnerability by sending crafted packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network.

Affected products

VendorProductAffectedFixed
Cisco Cisco Firepower Threat Defense Software — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 11 snort 2.9.20-0+deb11u1 DSA-5354-1
Debian 10 snort 2.9.20-0+deb10u1 DLA-3317-1
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS snort No fix yet —
Ubuntu 18.04 LTS snort No fix yet —
Ubuntu 16.04 LTS snort No fix yet —
Ubuntu 14.04 LTS snort No fix yet —

Advisories 3

References