description: A vulnerability in the interaction between the Server Message Block (SMB) protocol preprocessor and the Snort 3 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the configured policies or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error-checking when the Snort 3 detection engine is processing SMB traffic. An attacker could exploit this vulnerability by sending a crafted SMB packet stream through an affected device. A successful exploit could allow the attacker to cause the Snort process to reload, resulting in a DoS condition.
problem types: Improper Input Validation
affected:
{
vendor: Cisco
product: Cisco Firepower Threat Defense Software
versions:
version: 7.1.0, status: affected
version: 7.1.0.1, status: affected
version: 7.1.0.2, status: affected
version: 7.1.0.3, status: affected
version: 7.2.0, status: affected
version: 7.2.0.1, status: affected
version: 7.2.1, status: affected
version: 7.2.2, status: affected
version: 7.2.3, status: affected
version: 7.3.0, status: affected
version: 7.3.1, status: affected
version: 7.3.1.1, status: affected
}
metrics:
format: cvssV3_1
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
baseScore: 5.8
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
]
exploits: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.