Denial of service in Cisco Firepower Threat Defense

1) Resource exhaustion

EUVDB-ID: #VU8701

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-12245

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in SSL traffic decryption for Cisco Firepower Threat Defense (FTD) Software due to an error in how the Firepower Detection Snort Engine handles SSL traffic decryption and notifications to and from the Adaptive Security Appliance (ASA) handler. A remote attacker can send a steady stream of malicious Secure Sockets Layer (SSL) traffic through the device, trigger depletion of system memory and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

The vulnerability is addressed in the following versions: 6.2.0.3 or 6.2.0.2.

Vulnerable software versions

Cisco Firepower Threat Defense (FTD): 6.0.1 - 6.2.3

CPE2.3

• cpe:2.3:h:cisco_systems:cisco_ftd:6.0.1:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_ftd:6.1.0.1:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_ftd:6.2.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_ftd:6.2.1:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_ftd:6.2.2:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_ftd:6.2.3:*:*:*:*:*:*:*

External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-ftd

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.