Cisco Snort Vulnerability Allows Bypass of Configured File Policy for HTTP

CVE-2021-1494

Summary

A vulnerability exists within the Cisco Snort detection engine that compromises the security of HTTP file policies. This issue is attributed to the improper handling of specific HTTP header parameters, enabling an unauthenticated remote attacker to bypass established file policies. An attacker can exploit this vulnerability by sending specially crafted HTTP packets to an affected device, potentially leading to the delivery of a malicious payload. Organizations utilizing Cisco's Snort engine should take immediate measures to apply available patches and review configurations to mitigate this risk.

References