Rewterz Threat Advisory – CVE-2021-1223 – Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability

Rewterz Threat Advisory – Microsoft Windows SAFER/SRP Vulnerabilities

May 3, 2021

Rewterz Threat Alert – Financially Motivated Aggressive Group Carrying Out Ransomware Campaigns – Active IOCs

May 3, 2021

Rewterz Threat Advisory – CVE-2021-1223 – Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability

Severity

Medium

Analysis Summary

CVE-2021-1223

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

Impact

Unauthorized Access

Affected Vendors

Cisco

Affected Products

Cisco 3000 Series Industrial Security Appliances
Cisco Firepower Threat Defense (FTD) Software
1000 Series Integrated Services Routers (ISRs)
4000 Series Integrated Services Router(ISRs)
Cloud Services Router 1000V Series
Integrated Service Virtual Router(ISRs)

Remediation

Refer to cisco advisory for the complete list of affected product and their respective patches.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-filepolbypass-67DEwMe2

Rewterz Threat Advisory – Microsoft Windows SAFER/SRP Vulnerabilities

Rewterz Threat Alert – Financially Motivated Aggressive Group Carrying Out Ransomware Campaigns – Active IOCs

Rewterz Threat Advisory – CVE-2021-1223 – Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability

Severity

Analysis Summary

CVE-2021-1223

Impact

Affected Vendors

Affected Products

Remediation

Security Operations Centers across the region

Saudi Arabia

UAE

Oman

Pakistan