Ether Type Validation Flaw in Cisco Sourcefire Snort 3.0

CVE-2017-6657

Summary

An improper input validation flaw exists in Cisco Sourcefire Snort 3.0 prior to build 233. This vulnerability arises due to the mishandling of Ether Type validation. Specifically, the Snort++ architecture stores all protocol decoders in a single array, allowing attackers to craft packets with IP protocol numbers in the ether type field. This manipulation can confuse the decoder and lead to packet processing failures, such as crashes when legitimate packets like eth:llc:snap:icmp6 are processed without their corresponding IP headers. The fix introduced a validation check to ensure proper indexing of the decoder array, preventing out-of-range ether types.

References