PT-2017-17222 · Cisco · Cisco Sourcefire Snort

Published 2017-05-16 · Updated 2019-10-03 · CVE-2017-6657

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco Sourcefire Snort version 3.0 before build 233

Description The issue arises from the mishandling of Ether Type Validation, allowing crafted packets to confuse the Snort++ decoder. This occurs because valid ether type and IP protocol numbers do not overlap, and all protocol decoders are stored in a single array. As a result, packets with IP protocol numbers in the ether type field can cause the decoder to malfunction. For instance, an eth:llc:snap:icmp6 packet can lead to a crash due to the absence of an ip6 header for calculating the icmp6 checksum. Affected decoders include gre, llc, trans bridge, ciscometadata, linux sll, and token ring. The problem is resolved by adding a check in the packet manager to validate the ether type before indexing the decoder array, raising an error for out of range ether types.

Recommendations For Cisco Sourcefire Snort version 3.0 before build 233, apply the fix that adds a check in the packet manager to validate the ether type before indexing the decoder array. As a temporary workaround, consider restricting access to the affected decoders, including gre, llc, trans bridge, ciscometadata, linux sll, and token ring, to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2017-6657

Affected Products

Cisco Sourcefire Snort

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170515-snort · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6657 · Security Note
• http://blog.snort.org/2017/05/snort-vulnerabilities-found.html · Note
• http://securitytracker.com/id/1038483 · Note