A vulnerability classified as critical has been found in Cisco Firepower System Software (Firewall Software) (affected version unknown). This affects an unknown functionality of the component Detection Engine. The manipulation as part of a RAR File leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Multiple vulnerabilities in the Cisco Firepower System Software Detection Engine could allow an unauthenticated, remote attacker to bypass configured Malware and File Policies for RTF and RAR file types. For more information about these vulnerabilities, see the Details section of this advisory.

The weakness was disclosed 10/02/2019 as cisco-sa-20191002-firepwr-bypa as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is uniquely identified as CVE-2019-12696 since 06/04/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability.

The entry 142858 is pretty similar.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Firepower System Software

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion