CVE-2021-1494: 
Snort vulnerability analysis and mitigation

Multiple Cisco products are affected by a vulnerability (CVE-2021-1494) in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability was discovered by Santosh Krishnamurthy of Cisco during internal security testing and was first publicly disclosed on April 28, 2021. The affected products include various Cisco router series, security appliances, and Snort software versions earlier than 2.9.17.1 (Cisco Advisory).

The vulnerability stems from incorrect handling of specific HTTP header parameters in the Snort detection engine. The issue has been assigned a CVSS v3.1 Base Score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N. The vulnerability is classified under CWE-693 (Protection Mechanism Failure) (Cisco Advisory).

A successful exploitation of this vulnerability could allow an attacker to bypass a configured file policy for HTTP packets and deliver a malicious payload. This affects the security posture of the system by potentially allowing unauthorized file transfers that should have been blocked by the configured policies (Cisco Advisory).

The vulnerability can be exploited by an unauthenticated, remote attacker by sending crafted HTTP packets through an affected device. As of May 20, 2021, Cisco PSIRT was not aware of any public announcements or malicious use of this vulnerability (Cisco Advisory).

Cisco has released software updates that address this vulnerability. There are no workarounds available. For Cisco FTD Software, fixed versions include 6.4.0.12, 6.6.4, and 6.7.0.2. For Cisco IOS XE Software, fixed versions include 16.12.5, 17.3.3, and 17.4.1. For open source Snort, version 2.9.17.1 and later contain the fix (Cisco Advisory).