Cisco Firepower Threat Defense up to 6.2.3.3 Snort Detection Engine Packet input validation

Summaryinfo

A vulnerability was found in Cisco Firepower Threat Defense up to 6.2.3.3. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Snort Detection Engine. The manipulation as part of Packet results in input validation. This vulnerability was named CVE-2019-1691. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Cisco Firepower Threat Defense up to 6.2.3.3 (Firewall Software). Affected is some unknown processing of the component Snort Detection Engine. The manipulation as part of a Packet leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on availability. CVE summarizes:

A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated, remote attacker to cause the unexpected restart of the SNORT detection engine, resulting in a denial of service (DoS) condition. The vulnerability is due to the incomplete error handling of the SSL or TLS packet header during the connection establishment. An attacker could exploit this vulnerability by sending a crafted SSL or TLS packet during the connection handshake. An exploit could allow the attacker to cause the SNORT detection engine to unexpectedly restart, resulting in a partial DoS condition while the detection engine restarts. Versions prior to 6.2.3.4 are affected.

The bug was discovered 02/20/2019. The weakness was presented 02/21/2019 as cisco-sa-20190220-fpwr-ssltls- as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is traded as CVE-2019-1691 since 12/06/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 6.2.3.4 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Firepower Threat Defense

Version

• 6.2.3.0
• 6.2.3.1
• 6.2.3.2
• 6.2.3.3

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion