Cisco Firepower System Software SSL Logging DoS (cisco-sa-20170517-fpwr)

high Nessus Plugin ID 100426

Language:

Synopsis

The packet inspection software installed on the remote host is affected by a denial of service vulnerability.

Description

According to its version, the Cisco Firepower Threat Defense (FTD) software installed on the remote host is prior to 6.1.0.3 or else is 6.2.x prior to 6.2.1. It is, therefore, affected by multiple vulnerabilities :

- A denial of service vulnerability exists in the logging configuration of Secure Sockets Layer (SSL) policies. An unauthenticated, remote attacker can exploit this, via a flood of crafted TCP packets, to cause an excessive consumption of system resources. (CVE-2017-6632)

- An unspecified information disclosure vulnerability exists that allows an unauthenticated, remote attacker to disclose potentially sensitive information. Note that this vulnerability only affects 6.1.0.2.

- A denial of service vulnerability exists in the SSL detection engine that allows an unauthenticated, remote attacker to cause the Snort process to restart. Note that this vulnerability only affects 6.1.0.2.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvd07072.

Plugin Details

Severity: High

ID: 100426

File Name: cisco-sa-20170517-fpwr.nasl

Version: 1.7

Type: local

Family: CISCO

Published: 5/25/2017

Updated: 1/2/2019

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:firepower, cpe:/a:cisco:firepower_threat_defense

Required KB Items: Host/Cisco/ASA, Host/Cisco/ASA/model, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 5/17/2017

Vulnerability Publication Date: 5/17/2017

Reference Information

CVE: CVE-2017-6632

BID: 98523

CISCO-SA: cisco-sa-20170517-fpwr

CISCO-BUG-ID: CSCvd07072

Detections

Analytics