Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.1249
Cisco Snort++ Protocol Decoder Denial of Service Vulnerabilities
17 May 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cisco Snort++ Protocol Decoder
Publisher: Cisco Systems
Operating System: Cisco
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2017-6658 CVE-2017-6657
Original Bulletin:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170515-snort
- --------------------------BEGIN INCLUDED TEXT--------------------
Cisco Security Advisory
Cisco Snort++ Protocol Decoder Denial of Service Vulnerabilities
Medium
Advisory ID:
cisco-sa-20170515-snort
First Published:
2017 May 15 16:00 GMT
Version 1.0:
Final
Workarounds:
No workarounds available
CVE-2017-6657
CVE-2017-6658
CWE-399
CVSS Score:
Base 8.6, Temporal 8.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:X/RL:X/RC:X
Summary
Two vulnerabilities in the protocol decoders of Snort++ (Snort 3) could
allow an unauthenticated, remote attacker to create a Denial of Service
(DoS) condition.
The vulnerabilities are due to lack of validation in the protocol decoders.
An attacker could exploit these vulnerabilities by crafting a malicious
packet and sending it through the targeted device. A successful exploit
could allow the attacker to cause a DoS condition if the Snort process
restarts and traffic inspection is bypassed or traffic is dropped.
There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170515-snort
Affected Products
Vulnerable Products
These vulnerabilities affect Snort++ (Snort 3, currently in alpha testing
stage).
Products Confirmed Not Vulnerable
Current Snort stable releases are not affected by these vulnerabilities.
Workarounds
There are no workarounds that address these vulnerabilities.
Fixed Software
Fixes are available in the GitHub code repository tagged as BUILD_233.
Exploitation and Public Announcements
Cisco TALOS released a blog post on May 12, 2017 titled Snort++
Vulnerabilities Found. The Cisco Product Security Incident Response Team
(PSIRT) is not aware of any public malicious use of the vulnerabilities
described in this advisory.
Source
Cisco would like to thank Bhargava Shastry for reporting these
vulnerabilities.
Cisco Security Vulnerability Policy
To learn about Cisco security vulnerability disclosure policies and
publications, see the Security Vulnerability Policy. This document also
contains instructions for obtaining fixed software and receiving security
vulnerability information from Cisco.
URL
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170515-snort
Revision History
Version Description Section Status Date
1.0 Initial public release. - Final 2017-May-15
Legal Disclaimer
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND
OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT
OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES
THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the
distribution URL is an uncontrolled copy and may lack important information
or contain factual errors. The information in this document is intended for
end users of Cisco products.
Cisco Security Vulnerability Policy
To learn about Cisco security vulnerability disclosure policies and
publications, see the Security Vulnerability Policy. This document also
contains instructions for obtaining fixed software and receiving security
vulnerability information from Cisco.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWRu2H4x+lLeg9Ub1AQh9nw/+K28lnL5HnH3lWuUSEXF4fILRg08Fqb/c
LtHNu2DC6pk6DlB2IHcjZ51PYbd/z/oSknnhXUdQio/u3Gdgg0a0I8BZl2tyr1pN
PDPOfIxk5S3u5SjFhGJyOI2oU99XYGoJ03SgzYeFEUlt8BxqKlrB5rYoIk8rpdWV
CG9VJog5Jn6ZMxKDt8xk8uZ2Gj7U335oMZppjpa+QQUCAd/Pjcxbn+P5Xn7LiQUe
nshQjMDAvkrNL6jWpLgufyppwTcK9J+M0m5h2WUAw09QJDnMo7sjPDX5gBVNPBMG
tF4TpVmX5BrNf/he/G7ZqKcd3tqAm2ZxPxCw5mV9mHgXjylzkSMg1juwJ1EqkFZF
UGx9JHoMtYQWf3m1psr+uqOLAANbO5kxhJYOmx0Wu2W/UCfm4zLDXvFnCiXlMqJp
RojQPFir9Kr1njyD6YBwjLO2b51mqJazxFwB2BCTZvbNwsEvSfpG0P8VUB1/5Mfi
908XI9Sc03o3qI4/EtqUKKYhOPcM0Y2aTNYReGv+z24IDrSvuC3m6FnBCGPxceX9
t4DmNuD0aJMz5obkdo6v5uc5c+KkHwYlLJmlu7RLLrA3wb7cDHtI82/lrxbIRWu9
Dl/Z2DVBlYpSeX186EvFjXBUQsai/N/6mvw6ql4/tjgMjvn0RVncnX1MXOsGjw7i
G3owerhkx0A=
=F/FD
-----END PGP SIGNATURE-----