CVE-2017-3887: Medium severity Cisco Firepower Threat Defense vulnerability
A vulnerability in the detection engine that handles Secure Sockets Layer (SSL) packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition because the Snort process unexpectedly restarts. This vulnerability affects Cisco Firepower System Software prior to the first fixed release when it is configured with an SSL Decrypt-Resign policy. More Information: CSCvb62292. Known Affected Releases: 6.0.1 6.1.0 6.2.0. Known Fixed Releases: 6.2.0 6.1.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cisco Firepower System Softwareto a version that resolves this vulnerability.Fixed in 6.1.0.2Patch CSCvb62292 - Upgrade
Upgrade
Cisco Firepower System Softwareto a version that resolves this vulnerability.Fixed in 6.2.0Patch CSCvb62292 - Configuration
Ensure the system is not configured with an SSL Decrypt-Resign policy (this vulnerability affects releases prior to the first fixed release when configured with SSL Decrypt-Resign).
Cisco Firepower System Software SSL Decrypt-Resign policy configuration = not configured
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3887?
The severity of CVE-2017-3887 is considered high due to its potential to cause a denial of service.
How do I fix CVE-2017-3887?
To fix CVE-2017-3887, upgrade your Cisco Firepower Threat Defense software to the latest version as recommended by Cisco.
Who is affected by CVE-2017-3887?
CVE-2017-3887 affects users of Cisco Firepower Threat Defense software versions 6.0.1, 6.1.0, and 6.2.0.
What type of attack is possible with CVE-2017-3887?
CVE-2017-3887 allows an unauthenticated remote attacker to trigger a denial of service condition.
Is there a workaround for CVE-2017-3887?
There is no specific workaround for CVE-2017-3887; applying the recommended software updates is necessary.