CVE-2017-6632: High severity Cisco Firepower Threat Defense vulnerability

Published May 22, 2017

Updated

A vulnerability in the logging configuration of Secure Sockets Layer (SSL) policies for Cisco FirePOWER System Software 5.3.0 through 6.2.2 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to high consumption of system resources. The vulnerability is due to the logging of certain TCP packets by the affected software. An attacker could exploit this vulnerability by sending a flood of crafted TCP packets to an affected device. A successful exploit could allow the attacker to cause a DoS condition. The success of an exploit is dependent on how an administrator has configured logging for SSL policies for a device. This vulnerability affects Cisco FirePOWER System Software that is configured to log connections by using SSL policy default actions. Cisco Bug IDs: CSCvd07072.

Affected Software

21 affected components

Cisco Firepower Threat Defense=5.3.0

Cisco Firepower Threat Defense=5.4.0

Cisco Firepower Threat Defense=6.0.0

Cisco Firepower Threat Defense=6.0.1

Cisco Firepower Threat Defense=6.0.1.3

Cisco Firepower Threat Defense=6.1.0

Cisco Firepower Threat Defense=6.1.0.2

Cisco Firepower Threat Defense=6.2.0

Cisco Firepower Threat Defense=6.2.1

Cisco Firepower Threat Defense=6.2.2

Cisco Firepower Threat Defense=6.2_base

Cisco Secure Firewall Threat Defense=5.3.0

Cisco Secure Firewall Threat Defense=5.4.0

Cisco Secure Firewall Threat Defense=6.0.0

Cisco Secure Firewall Threat Defense=6.0.1

Cisco Secure Firewall Threat Defense=6.0.1.3

Cisco Secure Firewall Threat Defense=6.1.0

Cisco Secure Firewall Threat Defense=6.1.0.2

Cisco Secure Firewall Threat Defense=6.2.0

Cisco Secure Firewall Threat Defense=6.2.1

Cisco Secure Firewall Threat Defense=6.2.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CSCvd07072
Compensating control
To reduce the likelihood of DoS from crafted TCP packet logging, review and change the Cisco FirePOWER System Software SSL policy logging configuration so that the device does not log connections using SSL policy default actions (the exploit impact depends on whether logging is enabled for SSL policy default actions).

Event History

May 22, 2017

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

DescriptionWeakness

Data Sourced

via NVD·01:29 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-6632?

CVE-2017-6632 has been rated as a medium-severity vulnerability due to its potential for causing denial of service on affected Cisco FirePOWER System Software.

How do I fix CVE-2017-6632?

To remediate CVE-2017-6632, it is recommended to upgrade Cisco FirePOWER System Software to a version that is not affected, specifically versions later than 6.2.2.

What systems are affected by CVE-2017-6632?

CVE-2017-6632 affects Cisco FirePOWER Threat Defense versions 5.3.0 through 6.2.2.

Who can exploit CVE-2017-6632?

CVE-2017-6632 can be exploited by an unauthenticated remote attacker, making it particularly concerning for network security.

What is the impact of CVE-2017-6632?

The impact of CVE-2017-6632 can lead to significant resource consumption, resulting in a denial of service condition for Cisco FirePOWER systems.