Snort 3 GTP header flaw can restart Cisco detection engines
Original title: Multiple Cisco Products Snort 3 Denial of Service Vulnerability
A crafted fragmented UDP datagram with GTP extension headers can put the Snort 3 Detection Engine into an infinite loop.
Multiple Cisco products are affected by a flaw in the Snort 3 Detection Engine. An unauthenticated remote attacker can send a crafted, fragmented UDP datagram containing GPRS Tunneling Protocol extension headers so the engine unexpectedly restarts, causing a denial of service. Cisco attributes this to logic handling inside the codec when those headers are processed. A successful exploit can make the detection engine enter an infinite loop. The snippet does not name products, versions, or a CVE.
Unconfirmed: The snippet does not name affected products, fixed versions, a CVE, or exploitation.
- The flaw is in GTP extension-header handling in the codec.
- The trigger is a crafted fragmented UDP datagram.
- The stated result is an unexpected detection-engine restart.
- The snippet says the engine can enter an infinite loop.
Impact: Denial of service by restarting the detection engine
| Product | Affected |
|---|---|
| Cisco Snort 3 Detection Engine in multiple Cisco products | — |
From the original article
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.