PT-2022-6081 · Cisco · Snort 3+1

Published 2022-11-09 · Updated 2024-01-25 · CVE-2022-20950

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This is due to a lack of error-checking when SIP bidirectional flows are being inspected by Snort 3. An attacker could exploit this by sending a stream of crafted SIP traffic, potentially triggering a restart of the Snort 3 process and resulting in a denial of service (DoS) condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Allocation of Resources Without Limits

Weakness Enumeration

CWE-754

CWE-770

Related Identifiers

BDU:2023-00018

CVE-2022-20950

Affected Products

Cisco Ftd

Snort 3

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-20950 · Security Note
• https://bdu.fstec.ru/vul/2023-00018 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20950 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftdsnort3sip-dos-A4cHeArC · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftdsnort3sip-dos-A4cHeArC · Note