Cisco Firepower System Software up to 6.2.3 Server Message Block protection mechanism

Summaryinfo

A vulnerability was found in Cisco Firepower System Software up to 6.2.3. It has been classified as critical. This affects an unknown part of the component Server Message Block. Performing a manipulation results in protection mechanism. This vulnerability is reported as CVE-2018-0244. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco Firepower System Software up to 6.2.3 (Firewall Software). This affects an unknown code block of the component Server Message Block. The manipulation with an unknown input leads to a protection mechanism vulnerability. CWE is classifying the issue as CWE-693. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy to drop the Server Message Block (SMB) protocol if a malware file is detected. The vulnerability is due to how the SMB protocol handles a case in which a large file transfer fails. This case occurs when some pieces of the file are successfully transferred to the remote endpoint, but ultimately the file transfer fails and is reset. An attacker could exploit this vulnerability by sending a crafted SMB file transfer request through the targeted device. An exploit could allow the attacker to pass an SMB file that contains malware, which the device is configured to block. This vulnerability affects Cisco Firepower System Software when one or more file action policies are configured, on software releases prior to 6.2.3. Cisco Bug IDs: CSCvc20141.

The bug was discovered 04/18/2018. The weakness was disclosed 04/19/2018 with Cisco as cisco-sa-20180418-fss1 as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is uniquely identified as CVE-2018-0244 since 11/27/2017. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 01/30/2020).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103945†). The entries VDB-116879 and VDB-116876 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Firepower System Software

Version

• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion