CVE-2022-27255 - when do we get a signature ?

[MaxGutberletRM]

Gents,

after DEFCON, CVE-2022-27255 is creating a bit of a panic - and for good reasons, a quick "look" at my own corporate network shows me >100 devices affected usind the Realtek SDK in question.

As this is "simple" fixable with looking at the malformed SIP packages, can we get a signature update to the thread protection asap please ?

"It looks for "INVITE" messages with the string "m=audio" and triggers when there are more than 128 bytes (size of the allocated buffer by the Realtek SDK) and if none of them is a carriage return." (Source: bleepingcomputer)

Thx

MG

Details:

https://www.bleepingcomputer.com/news/security/exploit-out-for-critical-realtek-flaw-affecting-many-...

[Chris_Atkinson]

If not already please raise it with TAC and follow-up with your SE accordingly to track the request. 

Note we also support importing SNORT signatures, perhaps useful as an interim measure.

[CE_SE]

How quick are turn-around times for IPS signature updates addressing newly found vulnerabilities 

CVE Advisories 

This information might help. You can also subscribe to the 2nd one.