Cisco Firepower Threat Defense TLS 1.3 protection mechanism

Summaryinfo

A vulnerability classified as critical was found in Cisco Firepower Threat Defense. This impacts an unknown function of the component TLS 1.3 Handler. The manipulation results in protection mechanism. This vulnerability is reported as CVE-2020-3285. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco Firepower Threat Defense (Firewall Software) (version unknown). Affected is an unknown function of the component TLS 1.3 Handler. The manipulation with an unknown input leads to a protection mechanism vulnerability. CWE is classifying the issue as CWE-693. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the Transport Layer Security version 1.3 (TLS 1.3) policy with URL category functionality for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL. The vulnerability is due to a logic error with Snort handling of the connection with the TLS 1.3 policy and URL category configuration. An attacker could exploit this vulnerability by sending crafted TLS 1.3 connections to an affected device. A successful exploit could allow the attacker to bypass the TLS 1.3 policy and access URLs that are outside the affected device and normally would be dropped.

The weakness was disclosed 05/06/2020 as cisco-sa-ssl-bypass-O5tGum2n as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is traded as CVE-2020-3285 since 12/12/2019. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

The entries VDB-154811 and VDB-154808 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• Firepower Threat Defense

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion