Cisco Snort 3 SMTP MIME flaw can restart the detection engine
Original title: Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
An unauthenticated attacker can send crafted SMTP packets that make Snort 3 restart; Cisco has updates and no workarounds.
Multiple Cisco products using Snort 3 are affected by a flaw in the SMTP MIME decoder. Missing error checks while parsing MIME fields in SMTP headers let an unauthenticated remote attacker send crafted SMTP packets over an established connection. A successful exploit restarts the Snort 3 Detection Engine and causes a denial of service. Cisco has released software updates and says no workarounds address the issue.
Unconfirmed: The snippet does not name affected versions, fixed versions, or exploitation status.
- The flaw is missing error checking when SMTP header MIME fields are parsed.
- Exploitation uses crafted SMTP packets through an established connection.
- Impact is an unexpected restart of the Snort 3 Detection Engine.
- Cisco released software updates and states there are no workarounds.
Impact: Denial of service by restarting Snort 3
| Product | Affected |
|---|---|
| Cisco Snort 3 | — |
- 1.Install the Cisco software updates that address this vulnerability.
From the original article
Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a lack of error checking when the MIME fields of the SMTP header are parsed.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.