Cisco Firepower Threat Defense Software up to 7.4.2 access of memory location after end of buffer

Summaryinfo

A vulnerability classified as critical has been found in Cisco Firepower Threat Defense Software. This impacts an unknown function. The manipulation leads to access of memory location after end of buffer. This vulnerability is traded as CVE-2024-20330. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Firepower Threat Defense Software. It has been rated as critical. This issue affects some unknown processing. The manipulation with an unknown input leads to a access of memory location after end of buffer vulnerability. Using CWE to declare the problem leads to CWE-788. The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer. Impacted is availability. The summary by CVE is:

A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, which could cause the Snort detection engine to restart unexpectedly. This vulnerability is due to improper memory management when the Snort detection engine processes specific TCP or UDP packets. An attacker could exploit this vulnerability by sending crafted TCP or UDP packets through a device that is inspecting traffic using the Snort detection engine. A successful exploit could allow the attacker to restart the Snort detection engine repeatedly, which could cause a denial of service (DoS) condition. The DoS condition impacts only the traffic through the device that is examined by the Snort detection engine. The device can still be managed over the network. Note: Once a memory block is corrupted, it cannot be cleared until the Cisco Firepower 2100 Series Appliance is manually reloaded. This means that the Snort detection engine could crash repeatedly, causing traffic that is processed by the Snort detection engine to be dropped until the device is manually reloaded.

The advisory is shared at sec.cloudapps.cisco.com. The identification of this vulnerability is CVE-2024-20330 since 11/08/2023. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Firepower Threat Defense Software

Version

• 7.0.0
• 7.0.0.1
• 7.0.1
• 7.0.1.1
• 7.0.2
• 7.0.2.1
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.6.1
• 7.0.6.2
• 7.0.6.3
• 7.1.0
• 7.1.0.1
• 7.1.0.3
• 7.2.0
• 7.2.0.1
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.4.1
• 7.2.5
• 7.2.5.1
• 7.2.5.2
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.8.1
• 7.3.0
• 7.3.1
• 7.3.1.1
• 7.3.1.2
• 7.4.1
• 7.4.1.1
• 7.4.2

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion