PT-2017-17304 · Cisco · Cisco Firepower System

Published 2017-08-07 · Updated 2019-10-09 · CVE-2017-6766

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Firepower System Software versions 5.4.0 through 6.2.2

Description A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature could allow an unauthenticated, remote attacker to bypass the SSL policy for decrypting and inspecting traffic on an affected system. The issue arises from unexpected interaction with Known Key and Decrypt and Resign configuration settings of SSL policies when the affected software receives unexpected SSL packet headers. An attacker could exploit this by sending a crafted SSL packet through an affected device in a valid SSL session, potentially allowing traffic to flow through the system without being inspected.

Recommendations For Cisco Firepower System Software versions 5.4.0 through 6.2.2, consider disabling the SSL Decryption and Inspection feature until a patch is available to prevent potential bypass of the SSL policy. Restrict access to the SSL configuration settings to minimize the risk of exploitation. Avoid using the Decrypt and Resign configuration settings in SSL policies until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2017-6766

Affected Products

Cisco Firepower System

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-fpw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6766 · Vendor Advisory
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCve12652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6766 · Security Note