发布日期：2020-10-21
更新日期：2020-11-03

受影响系统：

Cisco Firepower Threat Defense Software
Cisco 3000 Series Industrial Security Appliances (ISAs)
Cisco 1000 Series Integrated Services Routers
Cisco Cloud Services Router 1000V Series
Cisco 4000 Series Integrated Services Routers
Cisco Integrated Services Virtual Routers
Cisco Meraki MX Series Security Appliances1

描述：

---

CVE(CAN) ID: CVE-2020-3299

Cisco Firepower Threat Defense是一套提供下一代防火墙服务的统一软件。Cisco 3000 Series Industrial Security Appliances是3000系列工业防火墙。Cisco 4000 Series Integrated Services Routers（ISRS）是4000系列企业级多业务路由器。
多个Cisco产品的Snort检测引擎存在文件策略绕过漏洞。该漏洞源于程序未对在分组响应中使用的修改HTTP数据包进行正确检测。未经身份认证的远程攻击者可通过向受影响设备发送特制的HTTP数据包利用该漏洞绕过已配置的HTTP文件策略。以下产品及版本受到影响：1000 Series Integrated Services Routers (ISRs)、3000 Series Industrial Security Appliances (ISAs)、4000 Series Integrated Services Routers (ISRs)、Cloud Services Router 1000V、Firepower Threat Defense (FTD) Software、Integrated Services Virtual Router (ISRv)和Meraki MX Series Security Appliances1。

<*来源：Santosh Krishnamurthy（Cisco）
  
  链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-bypass-3eCfd24j
*>

建议：

---

厂商补丁：

Cisco
-----
Cisco已经为此发布了一个安全公告（cisco-sa-ftd-bypass-3eCfd24j）以及相应补丁:
cisco-sa-ftd-bypass-3eCfd24j：Multiple Cisco Products SNORT HTTP Detection Engine File Policy Bypass Vulnerability
链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-bypass-3eCfd24j

浏览次数：5810
严重程度：0（网友投票）