#VU8701 Resource exhaustion in Cisco Firepower Threat Defense (FTD) - CVE-2017-12245

Vulnerability identifier: #VU8701

Vulnerability risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-12245

CWE-ID: CWE-400

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco Firepower Threat Defense (FTD)
Hardware solutions / Security hardware applicances

Vendor: Cisco Systems, Inc

Description
The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in SSL traffic decryption for Cisco Firepower Threat Defense (FTD) Software due to an error in how the Firepower Detection Snort Engine handles SSL traffic decryption and notifications to and from the Adaptive Security Appliance (ASA) handler. A remote attacker can send a steady stream of malicious Secure Sockets Layer (SSL) traffic through the device, trigger depletion of system memory and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation
The vulnerability is addressed in the following versions: 6.2.0.3 or 6.2.0.2.

Vulnerable software versions

Cisco Firepower Threat Defense (FTD): 6.0.1, 6.1.0.1, 6.2.0, 6.2.1, 6.2.2, 6.2.3

---

External links
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-ftd

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.