PT-2017-17201 · Cisco · Cisco Firepower System

Published 2017-05-22 · Updated 2019-10-09 · CVE-2017-6632

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco FirePOWER System Software versions 5.3.0 through 6.2.2

Description A vulnerability in the logging configuration of Secure Sockets Layer (SSL) policies could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to high consumption of system resources. The issue arises from the logging of certain TCP packets by the affected software. An attacker could exploit this by sending a flood of crafted TCP packets to an affected device, potentially causing a DoS condition. The success of an exploit depends on how an administrator has configured logging for SSL policies for a device. This issue affects software configured to log connections by using SSL policy default actions.

Recommendations For Cisco FirePOWER System Software versions 5.3.0 through 6.2.2, consider disabling the logging of certain TCP packets by adjusting the SSL policy default actions to minimize the risk of exploitation until a patch is available. Restrict access to the logging configuration to prevent unauthorized changes.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-399

Related Identifiers

CVE-2017-6632

Affected Products

Cisco Firepower System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-6632 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-fpwr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6632 · Vendor Advisory
• http://securityfocus.com/bid/98523 · Note