CVE-2017-6657

Cisco Sourcefire Snort 3.0 before build 233 mishandles Ether Type Validation. Since valid ether type and IP protocol numbers do not overlap, Snort++ stores all protocol decoders in a single array. That makes it possible to craft packets that have IP protocol numbers in the ether type field which will confuse the Snort++ decoder. For example, an eth:llc:snap:icmp6 packet will cause a crash because there is no ip6 header with which to calculate the icmp6 checksum. Affected decoders include gre, llc, trans_bridge, ciscometadata, linux_sll, and token_ring. The fix adds a check in the packet manager to validate the ether type before indexing the decoder array. An out of range ether type will raise 116:473.

• http://blog.snort.org/2017/05/snort-vulnerabilities-found.htmlThird Party Advisory
• http://www.securitytracker.com/id/1038483
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170515-snortVendor Advisory
• http://blog.snort.org/2017/05/snort-vulnerabilities-found.htmlThird Party Advisory
• http://www.securitytracker.com/id/1038483

Published

May 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6651A vulnerability in Cisco WebEx Meetings Server could allow u…
• CVE-2017-6652A vulnerability in the web framework of the Cisco TelePresen…
• CVE-2017-6653A vulnerability in the TCP throttling process for the GUI of…
• CVE-2017-6654A vulnerability in the web-based management interface of Cis…
• CVE-2017-6655A vulnerability in the Fibre Channel over Ethernet (FCoE) pr…6.5
• CVE-2017-6656A vulnerability in Session Initiation Protocol (SIP) call ha…
• CVE-2017-6658Cisco Sourcefire Snort 3.0 before build 233 has a Buffer Ove…
• CVE-2017-6659A vulnerability in the web-based management interface of Cis…
• CVE-2017-6661A vulnerability in the web-based management interface of Cis…
• CVE-2017-6662A vulnerability in the web-based user interface of Cisco Pri…
• CVE-2017-6663A vulnerability in the Autonomic Networking feature of Cisco…6.5
• CVE-2017-6664A vulnerability in the Autonomic Networking feature of Cisco…