Cisco Firepower Threat Defense Software up to 7.3.1.1 Snort access control

Summaryinfo

A vulnerability has been found in Cisco Firepower Threat Defense Software and classified as critical. The affected element is an unknown function of the component Snort. This manipulation causes access control. This vulnerability is handled as CVE-2023-20267. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in Cisco Firepower Threat Defense Software (Firewall Software). Affected by this vulnerability is an unknown part of the component Snort. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect integrity. The summary by CVE is:

A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially bypass IP address restrictions. This vulnerability exists because the configuration for IP geolocation rules is not parsed properly. An attacker could exploit this vulnerability by spoofing an IP address until they bypass the restriction. A successful exploit could allow the attacker to bypass location-based IP address restrictions.

The weakness was released 11/01/2023 as cisco-sa-ftdsnort3sip-bypass-LMz2ThKn. The advisory is shared at sec.cloudapps.cisco.com. This vulnerability is known as CVE-2023-20267 since 10/27/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 234502 (Cisco Firepower Threat Defense Software Snort 3 Geolocation IP Filter Bypass (cisco-sa-ftdsnort3sip-bypass-LMz2ThKn)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (234502). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Firepower Threat Defense Software

Version

• 6.7.0
• 6.7.0.1
• 6.7.0.2
• 6.7.0.3
• 7.0.0
• 7.0.0.1
• 7.0.1
• 7.0.1.1
• 7.0.2
• 7.0.2.1
• 7.0.3
• 7.0.4
• 7.0.5
• 7.1.0
• 7.1.0.1
• 7.1.0.2
• 7.1.0.3
• 7.2.0
• 7.2.0.1
• 7.2.1
• 7.2.2
• 7.2.3
• 7.3.0
• 7.3.1
• 7.3.1.1

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion