cisco-sa-snort-bypass-PTry37fX: Cisco Firepower Threat Defense Software TCP Snort 3 Detection Engine Bypass Vulnerability
First published: Wed Oct 23 2024(Updated: )
A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies on an affected system. Devices that are configured with Snort 2 are not affected by this vulnerability. This vulnerability is due to a logic error when handling embryonic (half-open) TCP connections. An attacker could exploit this vulnerability by sending a crafted traffic pattern through an affected device. A successful exploit could allow unintended traffic to enter the network protected by the affected device.Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-bypass-PTry37fXThis advisory is part of the October 2024 release of the Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: October 2024 Semiannual Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Firepower Management Center (FMC) and Firepower Threat Defense (FTD) Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-snort-bypass-PTry37fX?
The severity of cisco-sa-snort-bypass-PTry37fX is high, as it allows unauthenticated remote attackers to bypass security policies.
How do I fix cisco-sa-snort-bypass-PTry37fX?
To fix cisco-sa-snort-bypass-PTry37fX, apply the latest software update provided by Cisco for Firepower Threat Defense Software.
Which systems are affected by cisco-sa-snort-bypass-PTry37fX?
Cisco Firepower Threat Defense Software is primarily affected by the vulnerability cisco-sa-snort-bypass-PTry37fX.
Can cisco-sa-snort-bypass-PTry37fX be exploited remotely?
Yes, cisco-sa-snort-bypass-PTry37fX can be exploited by unauthenticated remote attackers.
What features are involved in the cisco-sa-snort-bypass-PTry37fX vulnerability?
The vulnerability cisco-sa-snort-bypass-PTry37fX involves the interaction between the TCP Intercept feature and the Snort 3 detection engine.
- agent/title
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/event
- agent/type
- agent/first-publish-date
- collector/cisco-recent
- source/Cisco
- agent/severity
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco firepower threat defense