cisco firepower_management_center 在移除最后引用时对内存的释放不恰当(内存泄露)

CVE编号

CVE-2021-40114

利用情况

暂无

补丁情况

N/A

披露时间

2021-10-28
漏洞描述
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper memory resource management while the Snort detection engine is processing ICMP packets. An attacker could exploit this vulnerability by sending a series of ICMP packets through an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device, causing the device to reload.
解决建议
建议您更新当前系统或软件至最新版,完成漏洞的修复。
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 cisco firepower_management_center 2.9.14.0 -
运行在以下环境
应用 cisco firepower_management_center 2.9.15 -
运行在以下环境
应用 cisco firepower_management_center 2.9.16 -
运行在以下环境
应用 cisco firepower_management_center 2.9.17 -
运行在以下环境
应用 cisco firepower_threat_defense * Up to
(excluding)
6.4.0.12
运行在以下环境
应用 cisco firepower_threat_defense * From
(including)
6.5.0
Up to
(excluding)
6.6.3
运行在以下环境
应用 cisco firepower_threat_defense * From
(including)
6.7.0
Up to
(excluding)
6.7.0.2
运行在以下环境
应用 cisco unified_threat_defense * From
(including)
16.12
Up to
(excluding)
16.12.6
运行在以下环境
应用 cisco unified_threat_defense * From
(including)
17.3
Up to
(excluding)
17.3.4a
运行在以下环境
应用 cisco unified_threat_defense * From
(including)
17.4
Up to
(excluding)
17.4.2
运行在以下环境
应用 snort snort * From
(including)
2.0.0
Up to
(excluding)
2.9.18
CVSS3评分
7.5
  • 攻击路径
    网络
  • 攻击复杂度
  • 权限要求
  • 影响范围
    未更改
  • 用户交互
  • 可用性
  • 保密性
  • 完整性
CWE-ID 漏洞类型
CWE-401 在移除最后引用时对内存的释放不恰当(内存泄露)
阿里云安全产品覆盖情况