PT-2021-2791 · Cisco · Cisco Isa+5

Santosh Krishnamurthy · Published 2021-04-28 · Updated 2023-05-22 · CVE-2021-1495

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense (FTD) versions (affected versions not specified) Cisco Catalyst versions (affected versions not specified) Cisco ISR versions (affected versions not specified) Cisco ISA versions (affected versions not specified) Cisco ISRv versions (affected versions not specified)

Description The issue is related to a vulnerability in the Snort detection engine of multiple Cisco products. This vulnerability could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP due to incorrect handling of specific HTTP header parameters, such as HTTP header parameters. An attacker could exploit this by sending crafted HTTP packets through an affected device, potentially allowing them to bypass a configured file policy for HTTP packets and deliver a malicious payload.

Recommendations For Cisco Firepower Threat Defense (FTD), update the Snort detection engine to a version that includes the fix for this issue. For Cisco Catalyst, apply the recommended security configuration changes to mitigate the risk of exploitation. For Cisco ISR, restrict access to the affected HTTP endpoints until a patch is available. For Cisco ISA, consider disabling the Snort detection engine temporarily as a workaround until a fix is applied. For Cisco ISRv, avoid using vulnerable HTTP header parameters in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-254

Related Identifiers

BDU:2021-02334

CVE-2021-1495

DLA-3317-1

DSA-5354-1

MGASA-2023-0117

Affected Products

Cisco Catalyst

Cisco Ftd

Cisco Isa

Cisco Isr

Cisco Isrv

Snort Detection Engine

References · 17

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-1495 · Vendor Advisory
• https://debian.org/security/2023/dsa-5354 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0117.html · Security Note
• https://ubuntu.com/security/CVE-2021-1495 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02334 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1495 · Security Note
• https://osv.dev/vulnerability/MGASA-2023-0117 · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3317 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5354-1 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-fp-bp-KfDdcQhc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1495 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-1495 · Security Note
• https://osv.dev/vulnerability/DLA-3317-1 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=27741 · Note
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.8 · Note