First published: Wed Apr 28 2021(Updated: )
Multiple Cisco products are affected by vulnerabilities in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. These vulnerabilities are due to incorrect handling of specific HTTP header parameters. An attacker could exploit these vulnerabilities by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload. Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-fp-bp-KfDdcQhc
Credit: These vulnerabilities were found by Santosh Krishnamurthy Cisco during internal security testing
Affected Software | Affected Version | How to fix |
---|---|---|
Cisco FTD Software | >=6.5.0<=6.6.0<6.6.42>=Earlier than 6.2.2=6.2.2=6.2.3=6.3.0<=6.4.0<6.4.0.12 | 6.6.42 6.4.0.12 |
Cisco UTD Snort IPS Engine Software for IOS XE | =17.4<17.4.1>=17.1=17.2<=17.3<17.3.3>=.12<16<=16.12<16.12.5 | 17.4.1 17.3.3 16.12.5 |
Cisco UTD Engine for IOS XE SD-WAN Software1 | =17.4<17.4.1>=17.1=17.2<=17.3<17.3.3>=.12<16<=16.12<16.12.5 | 17.4.1 17.3.3 16.12.5 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID is cisco-sa-http-fp-bp-KfDdcQhc.
Multiple Cisco products are affected including FTD Software, UTD Snort IPS Engine Software for IOS XE, and UTD Engine for IOS XE SD-WAN Software1.
The severity of this vulnerability is medium with a severity value of 5.8.
An attacker can exploit this vulnerability by bypassing a configured file policy for HTTP using specific HTTP header parameters.
You can find more information about this vulnerability on the Cisco Security Advisory website.