Snort 3 VBA decompression bug can crash Cisco detection engines
Original title: Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
Crafted VBA data can overflow stack data and restart the Snort 3 Detection Engine; Cisco has released updates.
A buffer overflow in the Snort 3 Visual Basic for Applications decompression engine affects multiple Cisco products. An unauthenticated remote attacker can send crafted VBA data and cause the Snort 3 Detection Engine to restart, creating a denial of service. The flaw is improper range checking of user-controlled VBA data during decompression. Cisco has released software updates; the excerpt cuts off before further details.
Unconfirmed: The excerpt does not name affected Cisco products, versions, or a CVE ID.
- The attacker does not need to authenticate.
- Successful exploitation overflows stack data in the detection engine.
- The result described is a denial of service, not code execution.
- Cisco says software updates address the vulnerability.
Impact: Unauthenticated remote denial of service of the detection engine
| Product | Affected |
|---|---|
| Cisco Snort 3 | — |
- 1.Install the Cisco software updates that address the Snort 3 VBA flaw.
From the original article
A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper range checking when Snort 3 decompresses VBA data, which is user controlled.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.