Cisco Firepower Threat Defense Software up to 7.4.1.1 Snort comparison using wrong factors

Summaryinfo

A vulnerability categorized as problematic has been discovered in Cisco Firepower Threat Defense Software. Affected is an unknown function of the component Snort. Executing a manipulation can lead to comparison using wrong factors. This vulnerability is tracked as CVE-2024-20342. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Cisco Firepower Threat Defense Software and classified as problematic. This vulnerability affects an unknown functionality of the component Snort. The manipulation with an unknown input leads to a comparison using wrong factors vulnerability. The CWE definition for the vulnerability is CWE-1025. The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses. As an impact it is known to affect availability. CVE summarizes:

Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured rate limiting filter. This vulnerability is due to an incorrect connection count comparison. An attacker could exploit this vulnerability by sending traffic through an affected device at a rate that exceeds a configured rate filter. A successful exploit could allow the attacker to successfully bypass the rate filter. This could allow unintended traffic to enter the network protected by the affected device.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability was named CVE-2024-20342 since 11/08/2023. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 209653 (Multiple Cisco Products Snort Rate Filter Bypass (cisco-sa-snort-rf-bypass-OY8f3pnM)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (209653). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Firepower Threat Defense Software

Version

• 6.7.0
• 6.7.0.1
• 6.7.0.2
• 6.7.0.3
• 7.0.0
• 7.0.0.1
• 7.0.1
• 7.0.1.1
• 7.0.2
• 7.0.2.1
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.6.1
• 7.1.0
• 7.1.0.1
• 7.1.0.2
• 7.1.0.3
• 7.2.0
• 7.2.0.1
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.4.1
• 7.2.5
• 7.2.5.1
• 7.2.5.2
• 7.3.0
• 7.3.1
• 7.3.1.1
• 7.3.1.2
• 7.4.0
• 7.4.1
• 7.4.1.1

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion