Posts for: #Cisco Firepower 1000 Series

Multiple Cisco Products Snort 3 MIME Denial of Service Vulnerabilities

#7.3  #7.3.0  #7.3.1  #7.3.1.1  #7.3.1.2  #7.4  #7.4.0  #7.4.1  #7.4.1.1  #7.4.2  #7.4.2.1  #7.4.2.2  #7.4.2.3  #7.4.2.4  #7.6  #7.6.0 
🚨 SEVERITY: MEDIUM — CVSS 6.5 Security Advisory

TL;DR 📌

Multiple Cisco products are affected by vulnerabilities in the Snort 3 MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or restart, leading to a denial of service. Cisco has released software updates to address these vulnerabilities, but no workarounds are available.

What happened 🕵️‍♂️

Cisco has identified vulnerabilities in the HTTP Multipurpose Internet Mail Extensions (MIME) Decoder within Snort 3, which could be exploited by an unauthenticated remote attacker. These vulnerabilities may lead to the disclosure of sensitive information or cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS) condition.

[]

Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Command Injection Vulnerability

#7.2  #7.2.6  #7.2.7  #7.2.8  #7.2.8.1  #7.2.9  #7.4  #7.4.1  #7.4.1.1  #7.4.2  #7.4.2.1  #7.6  #7.6.0  #Cisco  #Cisco 3000 Series Industrial Security Appliances (ISA)  #Cisco Firepower 1000 Series 
🚨 SEVERITY: MEDIUM — CVSS 6.0 Security Advisory

TL;DR 📌

A command injection vulnerability has been identified in Cisco Secure Firewall Management Center (FMC) and Secure Firewall Threat Defense (FTD) Software. This medium-severity issue allows authenticated local attackers to execute arbitrary commands on the underlying operating system. Cisco has released software updates to address this vulnerability, but no workarounds are available.

What happened 🕵️‍♂️

A vulnerability in the command-line interface (CLI) of Cisco Secure Firewall Management Center (FMC) and Secure Firewall Threat Defense (FTD) Software has been discovered. This flaw arises from improper input validation for specific CLI commands, enabling an authenticated local attacker to inject operating system commands. If exploited, the attacker could escape the restricted command prompt and execute arbitrary commands as root on the underlying operating system. Successful exploitation requires valid Administrator credentials.

[]

Cisco Secure Firewall Threat Defense Software Geolocation Remote Access VPN Bypass Vulnerability

#7.7  #7.7.0  #Cisco  #Cisco 3000 Series Industrial Security Appliances (ISA)  #Cisco Firepower 1000 Series  #Cisco Firepower 4100 Series  #Cisco Firepower 9000 Series  #Cisco Firepower Threat Defense Software  #Cisco Secure Firewall 1200 Series  #Cisco Secure Firewall 3100 Series  #Cisco Secure Firewall 4200 Series  #Cisco Secure Firewall Threat Defense Virtual 
🚨 SEVERITY: MEDIUM — CVSS 5.8 Security Advisory

TL;DR 📌

A medium-severity vulnerability has been identified in the Geolocation-Based Remote Access VPN feature of Cisco Secure Firewall Threat Defense Software. This flaw allows unauthenticated attackers to bypass security policies, potentially granting unauthorized access to restricted networks. No workarounds are available, and software updates are necessary to mitigate the risk.

What happened 🕵️‍♂️

A vulnerability in Cisco Secure Firewall Threat Defense (FTD) Software’s Geolocation-Based Remote Access (RA) VPN feature could enable an unauthenticated, remote attacker to bypass configured policies that control HTTP connections based on geographical location. This issue arises from incomplete URL parsing, allowing attackers to exploit it by sending crafted HTTP connections. Successful exploitation could lead to unauthorized access to networks that should otherwise be protected.

[]