CVE-2020-3299

Name	CVE-2020-3299
Description	Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured File Policy for HTTP packets and deliver a malicious payload.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3317-1, DSA-5354-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
snort (PTS)	buster	2.9.7.0-5	vulnerable
	buster (security)	2.9.20-0+deb10u1	fixed
	bullseye	2.9.15.1-5	vulnerable
	bullseye (security)	2.9.20-0+deb11u1	fixed
	sid	2.9.15.1-6	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
snort	source	buster	2.9.20-0+deb10u1	DLA-3317-1
snort	source	bullseye	2.9.20-0+deb11u1	DSA-5354-1
snort	source	(unstable)	2.9.15.1-1

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-bypass-3eCfd24j