思科部分产品受Snort IPS规则引擎漏洞影响，远程攻击者可借此绕过配置规则，思科已发布软件更新解决，无其他 workaround，此漏洞安全影响评级为中。

🥔思科多种产品受Snort IPS规则引擎漏洞影响，该漏洞源于HTTP数据包处理不当，攻击者可利用特制HTTP数据包绕过受影响系统的配置规则，使未检查的流量进入网络。

💻思科已发布软件更新来解决此漏洞，目前没有其他解决此漏洞的方法。相关咨询可在特定链接查看。

📄此咨询是思科ASA、FMC和FTD软件安全咨询捆绑发布的一部分，可查看完整的咨询及链接以了解更多信息。

Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unauthenticated, remote attacker to bypass the configured rules on an affected system. 

This vulnerability is due to incorrect HTTP packet handling. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured IPS rules and allow uninspected traffic onto the network.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-ips-bypass-uE69KBMd

This advisory is part of the May 2024 release of the Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: May 2024 Semiannual Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication.

Security Impact Rating: Medium
CVE: CVE-2024-20363