CVE-2023-20246: Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system...

Summary

Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system.

This vulnerability is due to a logic error that occurs when the access control policies are being...

What to do

Update snort snort to version 3.1.57.0 or later.
Update cisco ios_xe to version 17.12.2 or later.

Affected software

Vendor	Product	Affected versions
snort	snort	>= 3.0.0, < 3.1.57.0 `cpe:2.3:a:snort:snort::::::::`
cisco	secure_firewall_threat_defense	>= 7.0.0, <= 7.3.1.1 `cpe:2.3:a:cisco:secure_firewall_threat_defense::::::::`
cisco	ios_xe	>= 17.12, < 17.12.2 `cpe:2.3:o:cisco:ios_xe::::::::`

Original advisory text

Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system...

Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system.

This vulnerability is due to a logic error that occurs when the access control policies are being populated. An attacker could exploit this vulnerability by establishing a connection to an affected device. A successful exploit could allow the attacker to bypass configured access control rules on the affected system.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ci... Vendor Advisory