PT-2022-5809 · Cisco · Cisco Umbrella+3

Published

2022-11-09

·

Updated

2024-01-25

·

CVE-2022-20922

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense (FTD) with Snort 3 configured Cisco Meraki MX with Snort 3 configured Cisco Cyber Vision with Snort 3 configured Cisco Umbrella with Snort 3 configured
Description Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine could allow an unauthenticated, remote attacker to bypass the configured policies or cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to improper management of system resources when the Snort detection engine is processing SMB2 traffic. An attacker could exploit these vulnerabilities by sending a high rate of certain types of SMB2 packets through an affected device. A successful exploit could allow the attacker to trigger a reload of the Snort process, resulting in a DoS condition. If the snort preserve-connection option is enabled for the Snort detection engine, a successful exploit could also allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network.
Recommendations For Cisco Firepower Threat Defense (FTD) with Snort 3 configured, consider disabling the Snort preserve-connection option as a temporary workaround until a patch is available. For Cisco Meraki MX with Snort 3 configured, restrict access to the SMB2 processor to minimize the risk of exploitation. For Cisco Cyber Vision with Snort 3 configured, avoid using the Snort detection engine for SMB2 traffic until the issue is resolved. For Cisco Umbrella with Snort 3 configured, consider temporarily disabling the Snort detection engine until a patch is available.

Fix

Weakness Enumeration

CWE-244

Related Identifiers

BDU:2022-07214
CVE-2022-20922

Affected Products

Cisco Cyber Vision
Cisco Ftd
Cisco Meraki Mx
Cisco Umbrella