CVE-2020-3299 Multiple Cisco Products SNORT HTTP Detection Engine File Policy Bypass Vulnerability

What is CVE-2020-3299?

CVE-2020-3299 is a medium-severity vulnerability in Cisco Secure Firewall Threat Defense, published on 21 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured File Policy for HTTP packets and deliver a malicious payload.

Weakness: CWE-693

Which versions are affected by CVE-2020-3299?

It affects 2 products.

Products include Cisco Secure Firewall Threat Defense, Snort Snort.

How do I fix CVE-2020-3299?

Apply the vendor's patch.

Is CVE-2020-3299 being exploited?

There is no known exploitation of CVE-2020-3299 in the wild and no public exploit code.

Other vulnerabilities in Cisco Secure Firewall Threat Defense

• CVE-2024-20412 Hardcoded credentials in Cisco Firepower Threat Defense Software Critical 9.3
• CVE-2024-20330 Memory corruption in Cisco Firepower Threat Defense Software High 8.6
• CVE-2024-20339 Cisco Firepower Threat Defense Software for Firepower 2100 Series TLS Denial of Service Vulnerability High 8.6
• CVE-2024-20351 Cisco Firepower Threat Defense Software Snort Firewall Denial of Service Vulnerability High 8.6
• CVE-2023-20083 Denial of service in Cisco Firepower Threat Defense Software High 8.6

All Cisco Secure Firewall Threat Defense vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j2v5-cw33-rvx6, UBUNTU-CVE-2020-3299.