Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.  This vulnerability is due to improper error …

Overview

Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash. 

This vulnerability is due to improper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to enter an infinite loop, causing a DoS condition.

Affected

• snort >= 3.0.0-233, < 3.9.3.0
• cyber_vision = 3.0.0
• cyber_vision = 3.0.1
• cyber_vision = 3.0.2
• cyber_vision = 3.0.3
• cyber_vision = 3.0.4
• cyber_vision = 3.0.5
• cyber_vision = 3.0.6
• cyber_vision = 3.1.0
• cyber_vision = 3.1.1
• cyber_vision = 3.1.2
• cyber_vision = 3.2.0
• cyber_vision = 3.2.1
• cyber_vision = 3.2.2
• cyber_vision = 3.2.3
• cyber_vision = 3.2.4
• cyber_vision = 4.0.0
• cyber_vision = 4.0.1
• cyber_vision = 4.0.2
• cyber_vision = 4.0.3
• cyber_vision = 4.1.0
• cyber_vision = 4.1.1
• cyber_vision = 4.1.2
• cyber_vision = 4.1.3
• cyber_vision = 4.1.4
• cyber_vision = 4.1.5
• cyber_vision = 4.1.6
• cyber_vision = 4.1.7
• cyber_vision = 4.2.0
• cyber_vision = 4.2.1
• cyber_vision = 4.2.2
• cyber_vision = 4.2.3
• cyber_vision = 4.2.4
• cyber_vision = 4.2.6
• cyber_vision = 4.3.0
• cyber_vision = 4.3.1
• cyber_vision = 4.3.2
• cyber_vision = 4.3.3
• cyber_vision = 4.4.0
• cyber_vision = 4.4.1
• cyber_vision = 4.4.2
• cyber_vision = 4.4.3
• cyber_vision = 5.0.0
• cyber_vision = 5.0.1
• cyber_vision = 5.0.2
• cyber_vision = 5.1.0
• cyber_vision = 5.1.1
• cyber_vision = 5.1.2
• cyber_vision = 5.1.3
• cyber_vision = 5.2.0
• cyber_vision = 5.2.1
• cyber_vision = 5.3.0
• cyber_vision = 5.3.1
• cyber_vision = 5.3.2
• secure_firewall_threat_defense = 7.2.0
• secure_firewall_threat_defense = 7.2.0.1
• secure_firewall_threat_defense = 7.2.1
• secure_firewall_threat_defense = 7.2.2
• secure_firewall_threat_defense = 7.2.3
• secure_firewall_threat_defense = 7.2.4
• secure_firewall_threat_defense = 7.2.4.1
• secure_firewall_threat_defense = 7.2.5
• secure_firewall_threat_defense = 7.2.5.1
• secure_firewall_threat_defense = 7.2.5.2
• secure_firewall_threat_defense = 7.2.6
• secure_firewall_threat_defense = 7.2.7
• secure_firewall_threat_defense = 7.2.8
• secure_firewall_threat_defense = 7.2.8.1
• secure_firewall_threat_defense = 7.2.9
• secure_firewall_threat_defense = 7.2.10
• secure_firewall_threat_defense = 7.2.10.2
• secure_firewall_threat_defense = 7.3.0
• secure_firewall_threat_defense = 7.3.1
• secure_firewall_threat_defense = 7.3.1.1
• secure_firewall_threat_defense = 7.3.1.2
• secure_firewall_threat_defense = 7.4.0
• secure_firewall_threat_defense = 7.4.1
• secure_firewall_threat_defense = 7.4.1.1
• secure_firewall_threat_defense = 7.4.2
• secure_firewall_threat_defense = 7.4.2.1
• secure_firewall_threat_defense = 7.4.2.2
• secure_firewall_threat_defense = 7.4.2.3
• secure_firewall_threat_defense = 7.4.2.4
• secure_firewall_threat_defense = 7.4.3
• secure_firewall_threat_defense = 7.6.0
• secure_firewall_threat_defense = 7.6.1
• secure_firewall_threat_defense = 7.6.2
• secure_firewall_threat_defense = 7.6.2.1
• secure_firewall_threat_defense = 7.7.0
• secure_firewall_threat_defense = 7.7.10
• secure_firewall_threat_defense = 7.7.10.1
• unified_threat_defense_snort_intrusion_prevention_system_engine = 3.17.0s
• unified_threat_defense_snort_intrusion_prevention_system_engine = 3.17.1s
• unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.1
• unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.5
• unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.6
• unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.7a
• unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.9
• unified_threat_defense_snort_intrusion_prevention_system_engine = 16.6.10
• unified_threat_defense_snort_intrusion_prevention_system_engine = 16.12.1a

Remediation

Upgrade past the affected range:

• snort 3.9.3.0