PT-2015-3040 · Cisco · Cisco Firepower Extensible Operating System

Publicado 2015-11-19 · Atualizado 2015-11-19 · CVE-2015-6369

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Firepower Extensible Operating System version 1.1(1.160)

Description The issue is related to insufficient input validation in the USB driver, which can be exploited by an attacker with physical access to the device. This can lead to a denial of service via a crafted USB device that triggers invalid USB commands.

Recommendations For Cisco Firepower Extensible Operating System version 1.1(1.160), consider restricting access to the USB interface to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the use of USB devices on affected Firepower 9000 devices may help mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-00245

CVE-2015-6369

Produtos afetados

Cisco Firepower Extensible Operating System

Referências · 3

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151116-fire · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-6369 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-00245 · Nota de Segurança