PT-2021-1726 · Cisco+1 · Snort+1

Guillermo Muñoz Mozos · Published 2021-01-13 · Updated 2024-12-13 · CVE-2021-1224

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Multiple Cisco products (affected versions not specified)

Description: The issue is related to a vulnerability in the TCP Fast Open (TFO) protocol when used with the Snort detection engine. This vulnerability could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

ALT-PU-2021-1678

ALT-PU-2024-16610

BDU:2021-00416

CVE-2021-1224

DLA-3317-1

DSA-5354-1

MGASA-2023-0117

Affected Products

Alt Linux

Snort

References · 18

• https://advisories.mageia.org/MGASA-2023-0117.html · Security Note
• https://bdu.fstec.ru/vul/2021-00416 · Security Note
• https://osv.dev/vulnerability/DSA-5354-1 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-tfo-bypass-MmzZrtes · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1224 · Security Note
• https://ubuntu.com/security/CVE-2021-1224 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-1224 · Security Note
• https://debian.org/security/2023/dsa-5354 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0117 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3317-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1224 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-1224 · Vendor Advisory
• https://t.me/cvenotify/44094 · Telegram Post
• https://bugs.mageia.org/show_bug.cgi?id=27741 · Note