7.8
CVE-2021-40114
- EPSS 2.37%
- Veröffentlicht 27.10.2021 19:15:08
- Zuletzt bearbeitet 26.11.2024 16:09:02
- Quelle psirt@cisco.com
- CVE-Watchlists
- Unerledigt
LoginMultiple Cisco Products Snort Memory Leak Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Firepower Threat Defense Version < 6.4.0.12
Cisco ≫ Firepower Threat Defense Version >= 6.5.0 < 6.6.3
Cisco ≫ Firepower Threat Defense Version >= 6.7.0 < 6.7.0.2
Cisco ≫ Secure Firewall Management Center Version2.9.14.0
Cisco ≫ Secure Firewall Management Center Version2.9.15
Cisco ≫ Secure Firewall Management Center Version2.9.16
Cisco ≫ Secure Firewall Management Center Version2.9.17
Cisco ≫ Unified Threat Defense Version >= 16.12 < 16.12.6
Cisco ≫ Unified Threat Defense Version >= 17.3 < 17.3.4a
Cisco ≫ Unified Threat Defense Version >= 17.4 < 17.4.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.37% | 0.816 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 7.8 | 10 | 6.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:C
|
| psirt@cisco.com | 6.8 | 2.2 | 4 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
|
CWE-401 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html
https://www.debian.org/security/2023/dsa-5354
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-s2R7W9UU