CVE-2021-1224

Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-tfo-bypass-MmzZrtes	Vendor Advisory
https://www.debian.org/security/2023/dsa-5354

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:firepower_management_center:2.9.14.0:::::::*
	cpe:2.3:a:cisco:firepower_management_center:2.9.15:::::::*
	cpe:2.3:a:cisco:firepower_management_center:2.9.16:::::::*
	cpe:2.3:a:cisco:firepower_management_center:2.9.17:::::::*
	cpe:2.3:a:cisco:firepower_management_center:2.9.18:::::::*
	cpe:2.3:a:cisco:firepower_management_center:3.0.1:::::::*
	cpe:2.3:a:cisco:firepower_threat_defense::::::::

Configuration 2 (hide)

AND

cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4221_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4321_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4331_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4351_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4431_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4451-x_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:4461_integrated_services_router:-:::::::*
	cpe:2.3:h:cisco:csr_1000v:-:::::::*
	cpe:2.3:h:cisco:isa_3000:-:::::::*

Configuration 3 (hide)

cpe:2.3:a:snort:snort:*:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:cisco:meraki_mx64_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx64:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:cisco:meraki_mx64w_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx64w:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:cisco:meraki_mx67_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx67:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:cisco:meraki_mx67c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx67c:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND

cpe:2.3:o:cisco:meraki_mx67w_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx67w:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND

cpe:2.3:o:cisco:meraki_mx68_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx68:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND

cpe:2.3:o:cisco:meraki_mx68cw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx68cw:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND

cpe:2.3:o:cisco:meraki_mx68w_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx68w:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND

cpe:2.3:o:cisco:meraki_mx100_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx100:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND

cpe:2.3:o:cisco:meraki_mx84_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx84:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND

cpe:2.3:o:cisco:meraki_mx250_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx250:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND

cpe:2.3:o:cisco:meraki_mx450_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:meraki_mx450:-:*:*:*:*:*:*:*

History

22 May 2023, 18:57

Type	Values Removed	Values Added
CPE	cpe:2.3:h:cisco:isr_4461:-:::::::* cpe:2.3:h:cisco:isr_4321:-:::::::* cpe:2.3:h:cisco:isr_1100-8p:-:::::::* cpe:2.3:h:cisco:isr_1109-2p:-:::::::* cpe:2.3:h:cisco:isr_1111x-8p:-:::::::* cpe:2.3:h:cisco:isr_4351:-:::::::* cpe:2.3:h:cisco:isr_4221:-:::::::* cpe:2.3:h:cisco:isr_1100-4p:-:::::::* cpe:2.3:h:cisco:isr_4431:-:::::::* cpe:2.3:h:cisco:isr_4451-x:-:::::::* cpe:2.3:h:cisco:isr_1109-4p:-:::::::* cpe:2.3:h:cisco:isr_4331:-:::::::* cpe:2.3:h:cisco:isr_1101-4p:-:::::::*	cpe:2.3:h:cisco:4221_integrated_services_router:-:::::::* cpe:2.3:h:cisco:1101-4p_integrated_services_router:-:::::::* cpe:2.3:h:cisco:4331_integrated_services_router:-:::::::* cpe:2.3:h:cisco:4321_integrated_services_router:-:::::::* cpe:2.3:h:cisco:4461_integrated_services_router:-:::::::* cpe:2.3:h:cisco:4451-x_integrated_services_router:-:::::::* cpe:2.3:h:cisco:1109-2p_integrated_services_router:-:::::::* cpe:2.3:h:cisco:4431_integrated_services_router:-:::::::* cpe:2.3:h:cisco:1111x-8p_integrated_services_router:-:::::::* cpe:2.3:h:cisco:1100-4p_integrated_services_router:-:::::::* cpe:2.3:h:cisco:4351_integrated_services_router:-:::::::* cpe:2.3:h:cisco:1109-4p_integrated_services_router:-:::::::* cpe:2.3:h:cisco:1100-8p_integrated_services_router:-:::::::*

19 Feb 2023, 04:15

Type	Values Removed	Values Added
References		(MLIST) https://lists.debian.org/debian-lts-announce/2023/02/msg00011.html - (DEBIAN) https://www.debian.org/security/2023/dsa-5354 -

05 Aug 2022, 19:30

Type	Values Removed	Values Added
CWE	~~CWE-269~~	NVD-CWE-Other

Information

Published : 2021-01-13 22:15

Updated : 2024-02-04 21:23

NVD link : CVE-2021-1224

Mitre link : CVE-2021-1224

CVE.ORG link : CVE-2021-1224

JSON object : View

Products Affected

cisco

firepower_threat_defense
firepower_management_center
meraki_mx67
4431_integrated_services_router
meraki_mx67_firmware
1109-2p_integrated_services_router
4321_integrated_services_router
meraki_mx250
1101-4p_integrated_services_router
4451-x_integrated_services_router
meraki_mx64w_firmware
4461_integrated_services_router
meraki_mx84
meraki_mx450_firmware
meraki_mx84_firmware
1111x-8p_integrated_services_router
meraki_mx450
meraki_mx64_firmware
meraki_mx68
1109-4p_integrated_services_router
meraki_mx250_firmware
meraki_mx64
meraki_mx68cw
4331_integrated_services_router
meraki_mx67w
meraki_mx100_firmware
meraki_mx68w_firmware
csr_1000v
ios_xe
1100-4p_integrated_services_router
meraki_mx68cw_firmware
meraki_mx68w
meraki_mx100
4221_integrated_services_router
meraki_mx68_firmware
meraki_mx67c
meraki_mx67c_firmware
4351_integrated_services_router
meraki_mx64w
meraki_mx67w_firmware
1100-8p_integrated_services_router
isa_3000

snort

snort

CWE

NVD-CWE-Other CWE-693

Protection Mechanism Failure

5.3 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

JSON object

Attach tags to CVE-2021-1224

5.3^/10

5.0^/10

Attach tags to `CVE-2021-1224`