CVE-2021-40114
published 2021-10-27CVE-2021-40114: Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.37%
82.0th percentile
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_firepower_threat_defense_software | — | — |
| cisco | firepower_threat_defense | < 6.4.0.12 | 6.4.0.12 |
| cisco | firepower_threat_defense | >= 6.5.0 < 6.6.3 | 6.6.3 |
| cisco | firepower_threat_defense | >= 6.7.0 < 6.7.0.2 | 6.7.0.2 |
| cisco | products_snort | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | secure_firewall_management_center | — | — |
| cisco | unified_threat_defense | >= 16.12 < 16.12.6 | 16.12.6 |
| cisco | unified_threat_defense | >= 17.3 < 17.3.4a | 17.3.4a |
| cisco | unified_threat_defense | >= 17.4 < 17.4.2 | 17.4.2 |
| snort | snort | >= 0 < 2.9.18-r0 | 2.9.18-r0 |
| snort | snort | >= 0 < 2.9.18-r0 | 2.9.18-r0 |
| snort | snort | >= 0 < 2.9.18-r0 | 2.9.18-r0 |
| snort | snort | >= 0 < 2.9.18-r0 | 2.9.18-r0 |
| snort | snort | >= 0 < 2.9.18-r0 | 2.9.18-r0 |
| snort | snort | >= 0 < 2.9.18-r0 | 2.9.18-r0 |
| snort | snort | >= 0 < 2.9.18-r0 | 2.9.18-r0 |
| snort | snort | >= 0 < 2.9.18-r0 | 2.9.18-r0 |
| snort | snort | >= 0 < 2.9.18-r0 | 2.9.18-r0 |
| snort | snort | >= 2.0.0 < 2.9.18 | 2.9.18 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.5HIGH
vendor_cisco6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Multiple Cisco Products Snort Memory Leak Denial of Service Vulnerability
vendor_cisco·2021-10-27·CVSS 6.8
CVE-2021-40114 [MEDIUM] CWE-770 Multiple Cisco Products Snort Memory Leak Denial of Service Vulnerability
Multiple Cisco Products Snort Memory Leak Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This
Cisco
Multiple Cisco Products Snort Memory Leak Denial of Service Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-40114 Multiple Cisco Products Snort Memory Leak Denial of Service Vulnerability
CVE-2021-40114: Multiple Cisco Products Snort Memory Leak Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-770, CWE-770
Bug
GHSA
GHSA-5v43-2p8q-45m6: Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticat
ghsa_unreviewed·2022-05-24
CVE-2021-40114 [HIGH] CWE-401 GHSA-5v43-2p8q-45m6: Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticat
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload.
OSV
CVE-2021-40114: Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticat
osv·2021-10-27·CVSS 7.5
CVE-2021-40114 [HIGH] CVE-2021-40114: Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticat
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.debian.org/debian-lts-announce/2023/02/msg00011.htmlhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-s2R7W9UUhttps://www.debian.org/security/2023/dsa-5354https://lists.debian.org/debian-lts-announce/2023/02/msg00011.htmlhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-s2R7W9UUhttps://www.debian.org/security/2023/dsa-5354
2021-10-27
Published