CVE-2018-0230

A vulnerability in payload inspection for Ethernet Industrial Protocol (ENIP) traffic in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. This is due to incomplete processing during deep packet inspection. An attacker could exploit this by sending a crafted ENIP packet, potentially bypassing access control and intrusion policies.

A vulnerability in the TCP/IP traffic handling function of the Snort Detection Engine of Cisco Firepower Threat Defense (FTD) Software and Cisco FirePOWER Services could allow an unauthenticated, remote attacker to cause legitimate network traffic to be dropped, resulting in a denial of service (DoS). This is due to improper handling of TCP/IP traffic. An attacker could exploit this by sending a large amount of TCP/IP traffic, causing traffic drops and requiring a reboot.

A vulnerability in the interaction between the SMB protocol preprocessor and the Snort 3 detection engine in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies or cause a denial of service (DoS) condition. The issue is due to improper error-checking when processing SMB traffic. An attacker could exploit this by sending a crafted SMB packet stream, potentially causing the Snort process to reload and resulting in DoS.

A vulnerability in the internal packet processing of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series Firewalls could allow an unauthenticated, remote attacker to cause a denial of service (DoS). This is due to improper handling of certain packets sent to the inspection engine. An attacker could exploit this by sending a series of crafted packets, depleting all 9,472 byte blocks and causing traffic loss or unexpected reload.

A vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). This is due to a memory handling error when GRE traffic is processed. An attacker could exploit this by sending a crafted GRE payload, causing a device restart.

A vulnerability in the TLS handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain access to sensitive information. This is due to improper implementation of countermeasures against a Bleichenbacher attack on devices using SSL decryption policies. An attacker could exploit this by sending crafted TLS messages, potentially allowing decryption of previously captured TLS sessions.

A vulnerability in the connection handling function in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This is due to improper traffic handling when platform limits are reached. An attacker could exploit this by sending a high rate of UDP traffic, causing all new incoming connections to be dropped.

A vulnerability in the local malware analysis process of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to insufficient error handling. An attacker could send a crafted file through the device, causing the analysis process to crash and resulting in DoS. Manual intervention may be required.

A vulnerability in the TCP proxy functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This is due to improper handling of TCP flows. An attacker could exploit this by sending a crafted stream of TCP traffic, causing the device to reload.

A vulnerability in the Security Intelligence feed feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the Security Intelligence DNS feed. This is due to incorrect feed update processing. An attacker could send traffic through an affected device that should be blocked, to bypass device controls and send traffic to protected systems.