Multiple Vulnerabilities in Cisco's Snort Detection Engine Affecting SMB2 Traffic

CVE-2022-20922

Summary

Multiple vulnerabilities within the Server Message Block Version 2 (SMB2) processing capabilities of Cisco's Snort detection engine could be exploited by an unauthenticated remote attacker. By sending a high volume of specific SMB2 packets, attackers can disrupt the service by forcing the Snort process to reload, leading to a denial of service (DoS) condition. Furthermore, if the Snort preserve-connection option is enabled—default for Snort 3—attackers may also bypass existing security policies, allowing malicious payloads to infiltrate the protected network.

References