Cisco Firepower Threat Defense (FTD) Software vulnerabilities

A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies. The issue is due to a logic error when handling embryonic (half-open) TCP connections. Devices configured with Snort 2 are not affected.

A vulnerability in the TLS processing feature of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue occurs when processing TLS traffic, and exploitation by sending certain TLS traffic over IPv4 could cause the device to reload, impacting traffic through the device.

A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) Software for Firepower 2100 Series Appliances could allow an unauthenticated, remote attacker to cause memory corruption, leading to unexpected Snort detection engine restarts. The issue is due to improper memory management when processing specific TCP or UDP packets. Exploitation can cause repeated restarts, resulting in a DoS condition.

A vulnerability in the file policy feature used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured file policy to block an encrypted archive file. The issue is due to a logic error when a specific class of encrypted archive files is inspected.

A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause CPU usage to spike to 100%, stopping all traffic processing and resulting in a DoS condition. The issue is due to improper error checking when parsing ICMPv6 header fields. Sending a crafted ICMPv6 packet can exhaust CPU resources and stop traffic processing.

A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This is due to a lack of error-checking when SIP bidirectional flows are inspected by Snort 3. An attacker could exploit this by sending crafted SIP traffic, leading to a denial of service (DoS) condition.

A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privileges to execute configuration commands on an affected system. This is due to improper restriction of access to HTTPS endpoints. An attacker could exploit this by sending specific messages to the HTTPS handler, allowing configuration changes that should only be performed through Firepower Management Center (FMC).

A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. It is due to improper handling of the DNS reputation enforcement rule. An attacker could exploit this by sending crafted UDP packets through the device to force a buildup of UDP connections. This only affects FTD devices running Snort 3.

A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause unlimited memory consumption, leading to DoS. It is due to insufficient memory management for certain Snort events. An attacker can send crafted IP packets to generate specific Snort events, causing out-of-memory and traffic interruption; in some cases, device reload may occur.

A vulnerability in SSH connection processing for multi-instance deployments of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a DoS condition. It is due to improper error handling when an SSH session fails. An attacker can send a high rate of crafted SSH connections, leading to resource exhaustion and DoS; manual reload is required.

A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly. It is due to a lack of sufficient memory management protections under heavy SNMP polling loads. An attacker could exploit this by sending a high rate of SNMP requests to the SNMP daemon through the management interface.

A vulnerability in the packet processing functionality of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. It is due to inefficient memory management. An attacker could exploit this by sending a high rate of IPv4 or IPv6 traffic through the device, which must match a configured block action in an access control policy.

A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. This is due to improper configuration of the support tunnel feature. An attacker could enable the support tunnel, set a key, and derive the tunnel password, allowing them to run any system command with root access.

A vulnerability in the VPN System Logging functionality for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak that depletes system memory over time, leading to unexpected behaviors or device crashes. It is due to improper memory freeing for VPN logging events when sessions are created or deleted.

A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to perform a command injection attack. The issue is due to insufficient input validation. An attacker could exploit this by injecting commands into arguments for a specific command, allowing execution with root privileges.

Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, adjacent or remote attacker to cause a denial of service (DoS) condition. For more details, see the Details section of the Cisco advisory.

A vulnerability in the FTP inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The issue occurs when the software fails to release spinlocks under low memory conditions, if FTP inspection and an access control rule with an FTP file policy are configured. An attacker could exploit this by sending high-rate transit traffic to cause a low-memory condition.