CVE-2017-3885: Medium severity Cisco Secure Firewall Management Center vulnerability
A vulnerability in the detection engine reassembly of Secure Sockets Layer (SSL) packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition because the Snort process consumes a high level of CPU resources. Affected Products: This vulnerability affects Cisco Firepower System Software running software releases 6.0.0, 6.1.0, 6.2.0, or 6.2.1 when the device is configured with an SSL policy that has at least one rule specifying traffic decryption. More Information: CSCvc58563. Known Affected Releases: 6.0.0 6.1.0 6.2.0 6.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cisco Firepower System Softwareto a version that resolves this vulnerability.Fixed in 6.0.0 - Upgrade
Upgrade
Cisco Firepower System Softwareto a version that resolves this vulnerability.Fixed in 6.1.0 - Upgrade
Upgrade
Cisco Firepower System Softwareto a version that resolves this vulnerability.Fixed in 6.2.0 - Upgrade
Upgrade
Cisco Firepower System Softwareto a version that resolves this vulnerability.Fixed in 6.2.1 - Compensating control
If feasible, modify the SSL policy so it does not include any rule specifying traffic decryption to reduce exposure to the Snort detection engine SSL packet reassembly DoS.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3885?
CVE-2017-3885 has a medium severity rating due to its potential to lead to a denial of service condition.
How do I fix CVE-2017-3885?
To fix CVE-2017-3885, it is recommended to upgrade to a fixed version of Cisco Secure Firewall Management Center or Cisco Firepower Management Center Software.
What products are affected by CVE-2017-3885?
CVE-2017-3885 affects Cisco Secure Firewall Management Center and Cisco Firepower Management Center software versions 6.0.0 through 6.2.1.
Can CVE-2017-3885 be exploited remotely?
Yes, CVE-2017-3885 can be exploited by an unauthenticated remote attacker.
What is the impact of CVE-2017-3885 on affected systems?
The impact of CVE-2017-3885 on affected systems is high CPU resource consumption, potentially leading to service outage.