Cisco Snort 3 GRE flaw can restart the detection engine
Original title: Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability
Crafted nested GRE traffic can reload Snort 3 and cause either detection bypass or denial of service, depending on configuration.
Multiple Cisco products are affected by a flaw in Snort 3's GRE tunnel decapsulation. Improper handling of nested GRE traffic lets an unauthenticated remote attacker send a crafted GRE payload through an affected device. A successful exploit reloads the Snort 3 Detection Engine and can cause a detection bypass or a denial of service, depending on device configuration. The snippet points to further advisory details that are not included.
Unconfirmed: The snippet does not state affected versions, fixes, workarounds, or exploitation status.
- The flaw is improper handling of nested GRE traffic.
- An unauthenticated remote attacker sends a crafted GRE payload.
- Outcome is a bypass or denial of service depending on configuration.
- The reload affects the Snort 3 Detection Engine.
Impact: Detection bypass or denial of service via engine reload
| Product | Affected |
|---|---|
| Cisco Snort 3 | — |
From the original article
Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine. This vulnerability is due to improper handling of nested GRE traffic.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.