Cisco Firepower System Software up to 6.0.0 SSL SSL Connection resource consumption

Summaryinfo

A vulnerability marked as problematic has been reported in Cisco Firepower System Software up to 6.0.0. Impacted is an unknown function of the component SSL Handler. This manipulation as part of SSL Connection causes resource consumption. The identification of this vulnerability is CVE-2018-0233. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Cisco Firepower System Software up to 6.0.0 (Firewall Software) and classified as problematic. Affected by this vulnerability is an unknown code of the component SSL Handler. The manipulation as part of a SSL Connection leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

A vulnerability in the Secure Sockets Layer (SSL) packet reassembly functionality of the detection engine in Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause the detection engine to consume excessive system memory on an affected device, which could cause a denial of service (DoS) condition. The vulnerability is due to the affected software improperly handling changes to SSL connection states. An attacker could exploit this vulnerability by sending crafted SSL connections through an affected device. A successful exploit could allow the attacker to cause the detection engine to consume excessive system memory on the affected device, which could cause a DoS condition. The device may need to be reloaded manually to recover from this condition. This vulnerability affects Cisco Firepower System Software Releases 6.0.0 and later, running on any of the following Cisco products: Adaptive Security Appliance (ASA) 5500-X Series Firewalls with FirePOWER Services, Adaptive Security Appliance (ASA) 5500-X Series Next-Generation Firewalls, Advanced Malware Protection (AMP) for Networks, 7000 Series Appliances, Advanced Malware Protection (AMP) for Networks, 8000 Series Appliances, Firepower 4100 Series Appliances, FirePOWER 7000 Series Appliances, FirePOWER 8000 Series Appliances, Firepower 9300 Series Security Appliances, Firepower Threat Defense for Integrated Services Routers (ISRs), Firepower Threat Defense Virtual for VMware, Industrial Security Appliance 3000, Sourcefire 3D System Appliances. Cisco Bug IDs: CSCve23031.

The bug was discovered 04/18/2018. The weakness was shared 04/19/2018 as cisco-sa-20180418-fpsnort as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2018-0233 since 11/27/2017. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/26/2024). MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103930†). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Firepower System Software

Version

• 6.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion