PT-2020-2169 · Cisco · Cisco Ftd

Ilkin Gasimov · Published 2020-05-06 · Updated 2021-09-17 · CVE-2020-3283

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description The issue is related to a buffer underrun in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Firepower Threat Defense (FTD) Software. This could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device by sending a crafted SSL/TLS message. The vulnerability is due to a communication error between internal functions, which can cause the affected device to crash and reload.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2020-02073

CVE-2020-3283

Affected Products

Cisco Ftd

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tls-dos-4v5nmWtZ · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3283 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3283 · Vendor Advisory
• https://t.me/cvenotify/21108 · Telegram Post
• https://t.me/cvenotify/3593 · Telegram Post