PT-2017-17195 · Cisco · Cisco Firepower System+2

Published 2017-05-03 · Updated 2019-10-09 · CVE-2017-6625

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense versions 6.0.0 through 6.2.2 Cisco ASA with FirePOWER Module (affected versions not specified)

Description A vulnerability in the access control policy of Cisco Firepower System Software could allow an authenticated, remote attacker to cause an affected system to stop inspecting and processing packets, resulting in a denial of service (DoS) condition. This is due to improper SSL policy handling when packets are passed through the sensing interfaces of an affected system. An attacker could exploit this by sending crafted packets through a targeted system. The vulnerability affects Cisco Firepower System Software configured with the SSL policy feature.

Recommendations For Cisco Firepower Threat Defense versions 6.0.0 through 6.2.2, update the software to a version that properly handles SSL policy to prevent the denial of service condition. For Cisco ASA with FirePOWER Module, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2017-6625

Affected Products

Cisco Asa With Firepower Module

Cisco Firepower System

Cisco Ftd

References · 5

• https://osv.dev/vulnerability/CVE-2017-6625 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-ftd · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6625 · Security Note
• http://securitytracker.com/id/1038397 · Note
• http://securityfocus.com/bid/98292 · Note