Snort 3 control socket lets low-privilege local users run commands
Original title: Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability
Missing socket authentication also allows reading and writing Snort 3 process memory; Cisco has updates and no workaround.
A flaw in the Open Source Snort 3 control channel socket lets an authenticated local attacker with low privileges run arbitrary commands as the Snort 3 process user. The socket does not authenticate local connections. A successful exploit can also read and write Snort 3 process memory. Cisco has released software updates and says there are no workarounds.
Unconfirmed: The excerpt does not give a CVE ID, affected versions, or a fixed version.
- The attacker must already be a local user with low privileges.
- Exploitation is by connecting to the Snort 3 control channel socket.
- Impact includes command execution and process-memory read and write.
- Cisco says no workaround addresses the vulnerability.
Impact: Local user runs commands and reads or writes process memory
| Product | Affected |
|---|---|
| Cisco Open Source Snort 3 | — |
- 1.Install the Cisco software updates for Open Source Snort 3.
- Vendors
- Cisco
- Products
- Open Source Snort 3
From the original article
A vulnerability in the control channel socket implementation of Open Source Snort 3 could allow an authenticated, local attacker with low privileges to execute arbitrary commands as the Snort 3 process user. This vulnerability is due to a lack of authentication when a local user connects to the Snort control channel socket.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.