PT-2020-2166 · Cisco · Cisco Ftd

Published 2020-05-06 · Updated 2020-05-12 · CVE-2020-3179

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A memory handling error in the generic routing encapsulation (GRE) tunnel decapsulation feature could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The issue arises when GRE over IPv6 traffic is processed. An attacker could exploit this by sending crafted GRE over IPv6 packets with either IPv4 or IPv6 payload through an affected device, potentially causing the device to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

BDU:2020-02070

CVE-2020-3179

Affected Products

Cisco Ftd

References · 4

• https://osv.dev/vulnerability/CVE-2020-3179 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02070 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-dos-2-sS2h7aWe · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3179 · Security Note