Security features bypass in Sourcefire products - CVE-2021-1495

Vulnerability identifier: #VU52752

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-1495

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass a configured file policy for HTTP. 

The vulnerability exists due to incorrect handling of specific HTTP header parameters. A remote attacker can send specially crafted HTTP packets to bypass a configured file policy for HTTP packets and deliver a malicious payload. 

Cisco Firewall Threat Defense (FTD)
Cisco 1000 Series Integrated Services Routers
4000 Series Integrated Services Routers
Catalyst 8000V Edge Software
Catalyst 8200 Series Edge Platforms
Catalyst 8300 Series Edge Platforms
Catalyst 8500L Series Edge Platforms
Cloud Services Router 1000V Series
Integrated Services Virtual Routers
3000 Series Industrial Security Appliance (ISA)
Open Source Snort 2
Snort
Cisco UTD Snort IPS Engine Software for IOS XE
Cisco UTD Engine for IOS XE SD-WAN

Install updates from vendor's website.

Cisco Firewall Threat Defense (FTD) - addressed in versions 6.4.0.12, 6.6.4, 6.7.0.2
Cisco UTD Snort IPS Engine Software for IOS XE - addressed in versions 16.12.5, 17.3.3, 17.4.1
Cisco UTD Engine for IOS XE SD-WAN - addressed in versions 16.12.5, 17.3.3, 17.4.1
Snort - update to 2.9.17.1

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-fp-bp-KfDdcQhc

• Security features bypass in Multiple Cisco Products