Cisco ASA/AMP/FirePOWER Malware Detection HTTP Header input validation

Summaryinfo

A vulnerability, which was classified as critical, was found in Cisco ASA, AMP and FirePOWER. This impacts an unknown function of the component Malware Detection. The manipulation as part of HTTP Header results in input validation. This vulnerability is reported as CVE-2016-1345. The attack can be launched remotely. No exploit exists. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco ASA, AMP and FirePOWER (Firewall Software) (affected version not known). Affected is some unknown functionality of the component Malware Detection. The manipulation as part of a HTTP Header leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Cisco FireSIGHT System Software 5.4.0 through 6.0.1 and ASA with FirePOWER Services 5.4.0 through 6.0.0.1 allow remote attackers to bypass malware protection via crafted fields in HTTP headers, aka Bug ID CSCux22726.

The weakness was disclosed 03/30/2016 by Dikla Barda, Liad Mizrachi and Oded Vanunu with Check Point as cisco-sa-20160330-fp as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is traded as CVE-2016-1345 since 01/03/2016. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The advisory points out:

The vulnerability is due to improper input validation of fields in HTTP headers. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to bypass malicious file detection or blocking policies that are configured for the system, which could allow malware to pass through the system undetected.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityTracker (ID 1035437†). The entry VDB-81563 is pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Firewall Software

Vendor

• Cisco

Name

• AMP
• ASA
• FirePOWER

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion