Memory leak in Sourcefire products - CVE-2021-40114

Vulnerability identifier: #VU57799

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-40114

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak while the Snort detection engine is processing ICMP packets. A remote attacker can send a specially crafted ICMP packet, force the application to leak memory and perform denial of service attack.

Cisco Firewall Threat Defense (FTD)
Snort
Cisco UTD Snort IPS Engine Software for IOS XE
Cisco UTD Engine for IOS XE SD-WAN

Install update from vendor's website.

Cisco Firewall Threat Defense (FTD) - addressed in versions 6.4.0.12, 6.6.3, 6.7.0.2
Snort - update to 2.9.18
Cisco UTD Snort IPS Engine Software for IOS XE - addressed in versions 16.12.6, 17.3.4a, 17.4.2
Cisco UTD Engine for IOS XE SD-WAN - addressed in versions 16.12.6, 17.3.4a, 17.4.2

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-s2R7W9UU

• Denial of service in multiple Cisco Products