发布日期：2021-01-13
更新日期：2021-01-20

受影响系统：

Cisco Firepower Threat Defense Software
Cisco 3000 Series Industrial Security Appliances (ISAs)
Cisco 1000 Series Integrated Services Routers
Cisco Cloud Services Router 1000V Series
Cisco 4000 Series Integrated Services Routers
Cisco Integrated Services Virtual Routers
Cisco Meraki MX64
Cisco Meraki MX64W
Cisco Meraki MX67
Cisco Meraki MX67C
Cisco Meraki MX67W
Cisco Meraki MX68
Cisco Meraki MX68CW
Cisco Meraki MX68W
Cisco Meraki MX100
Cisco Meraki MX84
Cisco Meraki MX250
Cisco Meraki MX450

描述：

---

CVE(CAN) ID: CVE-2021-1224

Cisco 3000 Series Industrial Security Appliances是3000系列工业防火墙。Cisco 4000 Series Integrated Services Routers（ISRS）是4000系列企业级多业务路由器。Cisco Cloud Services Router 1000V Series是一款1000v系列云服务路由软件。
多款Cisco产品的Snort检测引擎存在文件策略绕过漏洞。该漏洞源于程序未对HTTP有效负载进行正确检测。未经身份认证的远程攻击者可通过向受影响设备发送带有HTTP有效负载的特制TFO数据包利用该漏洞绕过HTTP数据包的已配置文件策略。

<*来源：Guillermo Mu&#241;oz Mozos （BBVA）
  
  链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-tfo-bypass-MmzZ
*>

建议：

---

厂商补丁：

Cisco
-----
Cisco已经为此发布了一个安全公告（cisco-sa-snort-tfo-bypass-MmzZrtes）以及相应补丁:
cisco-sa-snort-tfo-bypass-MmzZrtes：Multiple Cisco Products Snort TCP Fast Open File Policy Bypass Vulnerability
链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-tfo-bypass-MmzZrtes

浏览次数：1299
严重程度：0（网友投票）