Integer overflow in Snort - CVE-2022-20685
Published: January 24, 2022
Vulnerability identifier: #VU59963
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-20685
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow in the Modbus preprocessor. A remote attacker can send specially crafted traffic through an affected system, trigger integer overflow and perform a denial of service (DoS) attack.
Affected software
Snort
Meraki MX
Cisco Cyber Vision Center
Cisco UTD Snort IPS Engine Software for IOS XE
Meraki MX
Cisco Cyber Vision Center
Cisco UTD Snort IPS Engine Software for IOS XE
How to mitigate CVE-2022-20685
Install updates from vendor's website.
Snort - addressed in versions 2.9.19, 3.1.11.0
Cisco Cyber Vision Center - update to 4.0.2
Cisco UTD Snort IPS Engine Software for IOS XE - addressed in versions 16.12.7, 17.3.5, 17.6.2
Cisco Cyber Vision Center - update to 4.0.2
Cisco UTD Snort IPS Engine Software for IOS XE - addressed in versions 16.12.7, 17.3.5, 17.6.2