CVE-2024-20342: 
Snort vulnerability analysis and mitigation

Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine, identified as CVE-2024-20342. The vulnerability was discovered during the resolution of a Cisco TAC support case and was first published on October 23, 2024. The affected systems include Open Source Snort 2, Open Source Snort 3, and Cisco products running vulnerable releases of Cisco FirePOWER Services or Cisco Firepower Threat Defense (FTD) Software with Snort enabled (Cisco Advisory).

The vulnerability stems from an incorrect connection count comparison in the rate filtering feature of the Snort detection engine. It has been assigned a CVSS Base Score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L. The vulnerability is classified under CWE-1025 (Comparison Using Wrong Factors) (Cisco Advisory).

A successful exploitation of this vulnerability could allow an attacker to bypass the rate filter, potentially allowing unintended traffic to enter the network protected by the affected device. The overall impact is organization-specific and depends on the importance of the assets that the rate filter was intended to protect (Cisco Advisory).

An unauthenticated, remote attacker could exploit this vulnerability by sending traffic through an affected device at a rate that exceeds a configured rate filter. The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of this vulnerability (Cisco Advisory).

Cisco has released software updates that address this vulnerability. For Cisco FTD Software, fixed releases include versions 7.0.6.2, 7.2.6, and 7.4.2. For Open Source Snort, version 3.1.74.0 contains the fix. There are no workarounds available for this vulnerability. Note that Snort 2 will not be fixed, and affected users must migrate to Snort 3 (Cisco Advisory).