PT-2023-9658 · Cisco · Cisco Ios Xe+1

Published 2023-11-08 · Updated 2024-10-03 · CVE-2024-20508

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cisco Unified Threat Defense (UTD) Snort Intrusion Prevention System (IPS) Engine for Cisco IOS XE Software (affected versions not specified)

Description A vulnerability in the Cisco UTD Snort IPS Engine could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service (DoS) condition on an affected device. This issue is due to insufficient validation of HTTP requests when they are processed by the Cisco UTD Snort IPS Engine. An attacker could exploit this vulnerability by sending a crafted HTTP request through an affected device, potentially triggering a reload of the Snort process. Depending on the failure action setting, successful exploitation could either allow the attacker to bypass security policies if set to fail-open or cause traffic to be dropped if set to fail-close.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2024-09354

CVE-2024-20508

Affected Products

Cisco Ios Xe

Cisco Utd Snort Ips Engine

References · 9

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-utd-snort3-dos-bypas-b4OUEwxD · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09354 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-20508 · Security Note
• https://osv.dev/vulnerability/CVE-2024-20508 · Vendor Advisory
• https://t.me/cvenotify/96935 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1839016947284926911 · Twitter Post
• https://twitter.com/CVEnew/status/1838983842180276347 · Twitter Post
• https://vuldb.com/?id.278483 · Note
• https://t.me/cvedetector/6336 · Telegram Post