PT-2023-17412 · Cisco · Cisco Ftd

Published 2023-11-01 · Updated 2024-01-25 · CVE-2023-20177

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A logic error in the SSL file policy implementation of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to unexpectedly restart when the SSL/TLS connection is configured with a URL Category and the Snort 3 detection engine. This occurs when a Snort 3 detection engine inspects an SSL/TLS connection that has either a URL Category configured on the SSL file policy or a URL Category configured on an access control policy with TLS server identity discovery enabled. Under specific, time-based constraints, an attacker could exploit this by sending a crafted SSL/TLS connection through an affected device, potentially triggering an unexpected reload of the Snort 3 detection engine and resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. The Snort 3 detection engine will restart automatically.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-244

Related Identifiers

CVE-2023-20177

Affected Products

Cisco Ftd

References · 6

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sa-ftd-snort3-urldos-OccFQTeX · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20177 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20177 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1719787627962847373 · Twitter Post
• https://twitter.com/CVEnew/status/1719759420597391855 · Twitter Post
• https://t.me/cibsecurity/73358 · Telegram Post