CVE-2021-1223: 
Snort vulnerability analysis and mitigation

Multiple Cisco products are affected by a vulnerability (CVE-2021-1223) in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability was discovered by Ilkin Gasimov of Cisco during internal security testing and was publicly disclosed on January 13, 2021. The affected products include Cisco 3000 Series Industrial Security Appliances (ISAs), Firepower Threat Defense (FTD) Software, and various router series running vulnerable versions of Cisco Unified Threat Defense (UTD) Snort IPS Engine (Cisco Advisory).

The vulnerability stems from incorrect handling of an HTTP range header in the Snort detection engine. The issue affects all open source Snort project releases earlier than Release 2.9.17. The vulnerability has been assigned a CVSS base score of 5.8, indicating a medium severity level with network attack vector, low attack complexity, and no privileges required for exploitation (Cisco Advisory).

A successful exploitation of this vulnerability could allow an attacker to bypass configured file policy for HTTP packets and deliver malicious payloads. This bypass could potentially lead to the delivery of malicious content that would otherwise be blocked by the security policies (Cisco Advisory).

The vulnerability can be exploited by sending crafted HTTP packets through an affected device. At the time of the advisory publication, Cisco PSIRT was not aware of any public announcements or malicious use of this vulnerability (Cisco Advisory).

Cisco has released software updates that address this vulnerability. Fixed versions include Cisco Firepower Threat Defense (FTD) releases 6.7.0 and later, Cisco UTD Snort IPS Engine Software for IOS XE 17.4.1, and open source Snort project releases 2.9.17 and later. No workarounds are available for this vulnerability (Cisco Advisory).