CVE-2021-1223

CVE-2021-1223 affects Cisco products with the Snort detection engine, where incorrect handling of HTTP range header (per Cisco/NVD wording) could allow an unauthenticated, remote attacker to bypass a configured HTTP file policy and deliver a malicious payload by sending crafted HTTP packets throu...

CVE-2021-1224

CVE-2021-1224 affects Cisco products via a TCP Fast Open (TFO) related bypass of HTTP file policies when used with Snort. The vulnerability arises from incorrect detection of HTTP payloads that are partially contained in the TFO handshake, enabling an unauthenticated, remote attacker to deliver a...

CVE-2021-40114

CVE-2021-40114 affects multiple Cisco products via the Snort detection engine’s ICMP processing, causing DoS from improper memory/resource management when handling ICMP packets. Root cause: memory/resource management flaw in ICMP packet processing. Impact: unauthenticated remote DoS, potentially ...

CVE-2020-3299

CVE-2020-3299 affects multiple Cisco products via the Snort detection engine, where incorrect handling of modified HTTP packets in chunked responses can bypass an HTTP File Policy. The attack would require sending crafted HTTP requests through an affected device to bypass policy and deliver a pay...

CVE-2021-1236

CVE-2021-1236 affects multiple Cisco products via the Snort application detection engine. The vulnerability stems from a flaw in the detection algorithm, enabling an unauthenticated, remote attacker to bypass configured policies by sending crafted packets, potentially delivering a malicious paylo...

CVE-2001-0669

CVE-2001-0669 affects multiple IDS products (Cisco Secure IDS, Cisco Catalyst 6000 IDS Module, Dragon Sensor 4.x, Snort before 1.8.1, ISS RealSecure Network Sensor 5.x/6.x before XPU 3.2, and ISS RealSecure Server Sensor 5.5/6.0 for Windows) where an attacker can bypass HTTP attack detection by u...

CVE-2023-20246

CVE-2023-20246 describes a vulnerability in Snort access control policies affecting multiple Cisco products, where a logic error during policy population could allow an unauthenticated, remote attacker to bypass configured access control rules. The impact is bypass of access controls with network...

CVE-2021-1495

CVE-2021-1495 affects Cisco Snort detection engine used in multiple Cisco products. The flaw arises from incorrect handling of specific HTTP header parameters, enabling an unauthenticated, remote attacker to bypass a configured HTTP File Policy by sending crafted HTTP packets, potentially deliver...

CVE-2003-0033

CVE-2003-0033 : Buffer overflow in Snort 1.8 and 1.9.x RPC preprocessor allows remote code execution via fragmented RPC packets. Affected: Snort before 1.9.1 (RPC preprocessor). Impact: remote compromise likely with root privileges. Mitigation: upgrade to Snort 1.9.1 or later (patches exist in De...

CVE-2008-1804

CVE-2008-1804 targets Sourcefire Snort up to version 2.8.0: the preprocessor spp_frag3.c fails to correctly identify packet fragments with dissimilar TTL values, enabling a remote attacker to bypass detection rules by using different TTLs on each fragment. The issue is tied to Snort’s fragment-ha...

CVE-2009-3641

The CVE-2009-3641 issue affects Snort 2.8.5.1 (and earlier) where a specially crafted IPv6 packet using -v triggers a crash (DoS). Fedora advisories (2009-10751/10783) document updating to 2.8.5.1 to fix the DoS and provide context that the vulnerability is triggered by printing IPv6 packets. Ope...

CVE-2000-1226

Snort 1.6 is affected. In straight ASCII packet logging mode or IDS mode with straight decoded ASCII packet logging, remote attackers can cause a denial of service (crash) by sending non-IP protocols that Snort cannot recognize, as demonstrated by an nmap protocol scan. This vulnerability is docu...

CVE-2007-0251

CVE-2007-0251 affects Snort 2.6.1.2, where an integer underflow in DecodeGRE (src/decode.c) can cause dereferencing of certain memory locations when processing crafted GRE packets. This may lead to log file corruption or leakage of sensitive information into logs. Connected sources confirm the vu...

CVE-2001-1558

CVE-2001-1558 describes an unknown vulnerability in Snort’s IP defragmenter (frag2) that could crash the process, affecting Snort before version 1.8.3. The vulnerability is documented in the NVD entry and corroborated by Red Hat’s CVE page; other connected records reference the same description. ...

CVE-2006-5276

CVE-2006-5276 describes a stack-based buffer overflow in the DCE/RPC preprocessor of Snort (and Sourcefire IDS) that can be triggered by crafted SMB traffic to remote receivers. Affected versions include Snort before 2.6.1.3 and 2.7 before beta 2, as well as the Sourcefire Intrusion Sensor. The v...

CVE-2016-1417

CVE-2016-1417 affects Snort 2.9.7.0-WIN32. It enables DLL hijacking through a Trojan tcapi.dll located in the same folder as the pcap being processed from a remote file share, allowing remote code execution when snort.exe loads the hijacked DLL. The vulnerability is triggered during processing of...

CVE-2006-6931

CVE-2006-6931 affects Snort before 2.6.1. The vulnerability arises during predicate evaluation in rule matching, enabling remote attackers to trigger CPU consumption and a detection outage (backtracking attack). Impact is a partial availability denial of service. Fixes are available in updated Sn...

CVE-2007-1398

The CVE-2007-1398 entry concerns the frag3 preprocessor in Snort relevant to inline mode on Linux without ip_conntrack. Affected versions include Snort 2.6.1.1, 2.6.1.2, and 2.7.0 beta. The underlying issue is a denial-of-service caused by certain UDP packets generated via send_morefrag_packet an...