CVE-2021-1224

Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.

Múltiples productos de Cisco están afectados por una vulnerabilidad con TCP Fast Open (TFO) cuando se usan en conjunto con el motor de detección Snort que podría permitir a un atacante remoto no autenticado omitir una política de archivos configurada para HTTP. La vulnerabilidad es debido a la detección incorrecta de la carga útil HTTP si está contenida al menos parcialmente dentro del protocolo de enlace de la conexión TFO. Un atacante podría explotar esta vulnerabilidad mediante el envío de paquetes TFO diseñados con una carga útil HTTP a través de un dispositivo afectado. Una explotación con éxito podría permitir al atacante omitir la política de archivos configurada para paquetes HTTP y entregar una carga útil maliciosa.