CVE-2017-6625: High severity Cisco Firepower Threat Defense vulnerability

Published May 3, 2017

Updated

A "Cisco Firepower Threat Defense 6.0.0 through 6.2.2 and Cisco ASA with FirePOWER Module Denial of Service" vulnerability in the access control policy of Cisco Firepower System Software could allow an authenticated, remote attacker to cause an affected system to stop inspecting and processing packets, resulting in a denial of service (DoS) condition. The vulnerability is due to improper SSL policy handling by the affected software when packets are passed through the sensing interfaces of an affected system. An attacker could exploit this vulnerability by sending crafted packets through a targeted system. This vulnerability affects Cisco Firepower System Software that is configured with the SSL policy feature. Cisco Bug IDs: CSCvc84361.

Affected Software

14 affected components

Cisco Firepower Threat Defense=6.0.0

Cisco Firepower Threat Defense=6.0.1

Cisco Firepower Threat Defense=6.1.0

Cisco Firepower Threat Defense=6.1.0.2

Cisco Firepower Threat Defense=6.2.0

Cisco Firepower Threat Defense=6.2.1

Cisco Firepower Threat Defense=6.2.2

Cisco Secure Firewall Threat Defense=6.0.0

Cisco Secure Firewall Threat Defense=6.0.1

Cisco Secure Firewall Threat Defense=6.1.0

Cisco Secure Firewall Threat Defense=6.1.0.2

Cisco Secure Firewall Threat Defense=6.2.0

Cisco Secure Firewall Threat Defense=6.2.1

Cisco Secure Firewall Threat Defense=6.2.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CSCvc84361
Compensating control
If Cisco Firepower System Software is configured with the SSL policy feature, adjust the configuration to avoid using SSL policy on the targeted sensing interfaces so crafted packets cannot trigger the improper SSL policy handling that stops inspection and packet processing.

Event History

May 3, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionWeakness

Data Sourced

via NVD·09:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-6625?

CVE-2017-6625 is classified as a denial of service vulnerability, which can significantly impact the affected Cisco Firepower systems.

How do I fix CVE-2017-6625?

To mitigate CVE-2017-6625, users should upgrade their Cisco Firepower Threat Defense systems to versions 6.2.3 or later.

Who is affected by CVE-2017-6625?

CVE-2017-6625 affects Cisco Firepower Threat Defense systems running software versions 6.0.0 through 6.2.2.

What type of attack does CVE-2017-6625 enable?

CVE-2017-6625 enables authenticated, remote attackers to cause denial of service on affected Cisco Firepower systems.

Is CVE-2017-6625 exploitable without authentication?

No, CVE-2017-6625 requires an authenticated user to exploit the vulnerability and cause a denial of service.