cisco-sa-snort-filepolbypass-67DEwMe2: Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of an HTTP range header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-filepolbypass-67DEwMe2
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-snort-filepolbypass-67DEwMe2?
The severity of cisco-sa-snort-filepolbypass-67DEwMe2 is high due to the potential for unauthenticated remote access to bypass file policies.
How do I fix cisco-sa-snort-filepolbypass-67DEwMe2?
To fix cisco-sa-snort-filepolbypass-67DEwMe2, update the Snort detection engine to the latest version provided by Cisco.
Who is affected by cisco-sa-snort-filepolbypass-67DEwMe2?
Multiple Cisco products utilizing the Snort detection engine are affected by cisco-sa-snort-filepolbypass-67DEwMe2.
What could an attacker achieve with cisco-sa-snort-filepolbypass-67DEwMe2?
An attacker could exploit cisco-sa-snort-filepolbypass-67DEwMe2 to bypass configured file policies for HTTP, potentially leading to data exfiltration.
What is the cause of the vulnerability cisco-sa-snort-filepolbypass-67DEwMe2?
The cause of cisco-sa-snort-filepolbypass-67DEwMe2 is improper handling of the HTTP range header by the Snort detection engine.