MGASA-2023-0117 - Updated snort packages fix security vulnerability

Publication date: 31 Mar 2023
URL: https://advisories.mageia.org/MGASA-2023-0117.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2020-3299,
     CVE-2020-3315,
     CVE-2021-1223,
     CVE-2021-1224,
     CVE-2021-1236,
     CVE-2021-1494,
     CVE-2021-1495,
     CVE-2021-34749,
     CVE-2021-40114

Multiple Cisco products are affected by a vulnerability in the Snort
detection engine that could allow an unauthenticated, remote attacker to
bypass a configured File Policy for HTTP. The vulnerability is due to
incorrect detection of modified HTTP packets used in chunked responses. An
attacker could exploit this vulnerability by sending crafted HTTP packets
through an affected device. A successful exploit could allow the attacker
to bypass a configured File Policy for HTTP packets and deliver a
malicious payload. (CVE-2020-3299)

Multiple Cisco products are affected by a vulnerability in the Snort
detection engine that could allow an unauthenticated, remote attacker to
bypass the configured file policies on an affected system. The
vulnerability is due to errors in how the Snort detection engine handles
specific HTTP responses. An attacker could exploit this vulnerability by
sending crafted HTTP packets that would flow through an affected system. A
successful exploit could allow the attacker to bypass the configured file
policies and deliver a malicious payload to the protected network.
(CVE-2020-3315)

Multiple Cisco products are affected by a vulnerability in the Snort
detection engine that could allow an unauthenticated, remote attacker to
bypass a configured file policy for HTTP. The vulnerability is due to
incorrect handling of an HTTP range header. An attacker could exploit this
vulnerability by sending crafted HTTP packets through an affected device.
A successful exploit could allow the attacker to bypass configured file
policy for HTTP packets and deliver a malicious payload. (CVE-2021-1223)

Multiple Cisco products are affected by a vulnerability with TCP Fast Open
(TFO) when used in conjunction with the Snort detection engine that could
allow an unauthenticated, remote attacker to bypass a configured file
policy for HTTP. The vulnerability is due to incorrect detection of the
HTTP payload if it is contained at least partially within the TFO
connection handshake. An attacker could exploit this vulnerability by
sending crafted TFO packets with an HTTP payload through an affected
device. A successful exploit could allow the attacker to bypass
configured file policy for HTTP packets and deliver a malicious payload.
(CVE-2021-1224)

Multiple Cisco products are affected by a vulnerability in the Snort
application detection engine that could allow an unauthenticated, remote
attacker to bypass the configured policies on an affected system. The
vulnerability is due to a flaw in the detection algorithm. An attacker
could exploit this vulnerability by sending crafted packets that would
flow through an affected system. A successful exploit could allow the
attacker to bypass the configured policies and deliver a malicious
payload to the protected network. (CVE-2021-1236)

Multiple Cisco products are affected by vulnerabilities in the Snort
detection engine that could allow an unauthenticated, remote attacker to
bypass a configured file policy for HTTP. These vulnerabilities are due
to incorrect handling of specific HTTP header parameters. An attacker
could exploit these vulnerabilities by sending crafted HTTP packets
through an affected device. A successful exploit could allow the attacker
to bypass a configured file policy for HTTP packets and deliver a
malicious payload. (CVE-2021-1494)

Multiple Cisco products are affected by a vulnerability in the Snort
detection engine that could allow an unauthenticated, remote attacker to
bypass a configured file policy for HTTP. The vulnerability is due to
incorrect handling of specific HTTP header parameters. An attacker could
exploit this vulnerability by sending crafted HTTP packets through an
affected device. A successful exploit could allow the attacker to bypass a
configured file policy for HTTP packets and deliver a malicious payload.
(CVE-2021-1495)

A vulnerability in Server Name Identification (SNI) request filtering of
Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD),
and the Snort detection engine could allow an unauthenticated, remote
attacker to bypass filtering technology on an affected device and
exfiltrate data from a compromised host. This vulnerability is due to
inadequate filtering of the SSL handshake. An attacker could exploit this
vulnerability by using data from the SSL client hello packet to
communicate with an external server. A successful exploit could allow the
attacker to execute a command-and-control attack on a compromised host and
perform additional data exfiltration attacks. (CVE-2021-34749)

Multiple Cisco products are affected by a vulnerability in the way the
Snort detection engine processes ICMP traffic that could allow an
unauthenticated, remote attacker to cause a denial of service (DoS)
condition on an affected device. The vulnerability is due to improper
memory resource management while the Snort detection engine is processing
ICMP packets. An attacker could exploit this vulnerability by sending a
series of ICMP packets through an affected device. A successful exploit
could allow the attacker to exhaust resources on the affected device,
causing the device to reload. (CVE-2021-40114)

References:
- https://bugs.mageia.org/show_bug.cgi?id=27741
- https://www.debian.org/lts/security/2023/dla-3317
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3299
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3315
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1223
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1224
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1236
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1494
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1495
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34749
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40114

SRPMS:
- 8/core/snort-2.9.20-1.mga8

Mageia 2023-0117: snort security update

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HT...

Summary

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured File Policy for HTTP packets and deliver a malicious payload. (CVE-2020-3299)
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured file policies on an affected system. The vulnerability is due to errors in how the Snort detection engine handles specific HTTP responses. An attacker could exploit this vulnerability by sending crafted HTTP packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured file policies and deliver a malicious payload to the protected network. (CVE-2020-3315)
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of an HTTP range header. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload. (CVE-2021-1223)
Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload. (CVE-2021-1224)
Multiple Cisco products are affected by a vulnerability in the Snort application detection engine that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. The vulnerability is due to a flaw in the detection algorithm. An attacker could exploit this vulnerability by sending crafted packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured policies and deliver a malicious payload to the protected network. (CVE-2021-1236)
Multiple Cisco products are affected by vulnerabilities in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. These vulnerabilities are due to incorrect handling of specific HTTP header parameters. An attacker could exploit these vulnerabilities by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload. (CVE-2021-1494)
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of specific HTTP header parameters. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload. (CVE-2021-1495)
A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host. This vulnerability is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks. (CVE-2021-34749)
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload. (CVE-2021-40114)