PT-2021-2259 · Cisco · Snort

Published 2021-03-03 · Updated 2024-11-18 · CVE-2021-1285

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco products (affected versions not specified)

Description: The issue is related to improper handling of error conditions when processing Ethernet frames in the Snort detection engine, which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. An attacker could exploit this by sending malicious Ethernet frames through an affected device, potentially exhausting disk space, preventing administrators from logging in, or causing the device to fail to boot up correctly. Manual intervention is required to recover from this situation.

Recommendations: For all affected versions, update to the latest software version released by Cisco that addresses this issue. As a temporary workaround, consider restricting access to the Ethernet Frame Decoder of the Snort detection engine until a patch is available. Contact the Cisco Technical Assistance Center (TAC) for assistance in recovering a device that has been affected by this issue.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2021-01245

CVE-2021-1285

Affected Products

Snort

References · 5

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-ethernet-dos-HGXgJH8n · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01245 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1285 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-ethernet-dos-HGXgJH8n · Note
• https://twitter.com/CVEnew/status/1858538965365911994 · Twitter Post