Product:
Snort 3
Summary
Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the disclosure of possible sensitive data or cause the Snort 3 Detection Engine to crash. This vulnerability is due to an error in the logic of buffer handling when the MIME fields of the HTTP header are parsed, resulting in a buffer under-read. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection that is parsed by Snort 3.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-20359 |
Exploitation
To exploit this vulnerability, an attacker must send specially crafted HTTP packets to the Snort 3 system. If successful, this could lead to the unexpected restarting of the Snort 3 Detection Engine, resulting in a denial of service condition, or the disclosure of sensitive information from the Snort 3 data stream. The attacker does not need any authentication or special privileges to carry out this attack.
Affected Products
- Snort 3 Detection Engine: Vulnerable to buffer under-read due to improper handling of MIME fields in HTTP headers.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of Snort 3 and apply any available patches. Additionally, monitoring network traffic for unusual patterns and implementing strict access controls can help reduce the risk of exploitation.