PT-2023-9658 · Cisco · Cisco Ios Xe+1
CVE-2024-20508
·
Publicado
2023-11-08
·
Atualizado
2024-10-03
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Cisco Unified Threat Defense (UTD) Snort Intrusion Prevention System (IPS) Engine for Cisco IOS XE Software (affected versions not specified)
Description
A vulnerability in the Cisco UTD Snort IPS Engine could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service (DoS) condition on an affected device. This issue is due to insufficient validation of HTTP requests when they are processed by the Cisco UTD Snort IPS Engine. An attacker could exploit this vulnerability by sending a crafted HTTP request through an affected device, potentially triggering a reload of the Snort process. Depending on the failure action setting, successful exploitation could either allow the attacker to bypass security policies if set to fail-open or cause traffic to be dropped if set to fail-close.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Memory Corruption
Heap Based Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Ios Xe
Cisco Utd Snort Ips Engine