CVE-2017-6766: High severity cisco firesight system vulnerability
A vulnerability in the Secure Sockets Layer (SSL) Decryption and Inspection feature of Cisco Firepower System Software 5.4.0, 5.4.1, 6.0.0, 6.1.0, 6.2.0, 6.2.1, and 6.2.2 could allow an unauthenticated, remote attacker to bypass the SSL policy for decrypting and inspecting traffic on an affected system. The vulnerability is due to unexpected interaction with Known Key and Decrypt and Resign configuration settings of SSL policies when the affected software receives unexpected SSL packet headers. An attacker could exploit this vulnerability by sending a crafted SSL packet through an affected device in a valid SSL session. A successful exploit could allow the attacker to bypass the SSL decryption and inspection policy for the affected system, which could allow traffic to flow through the system without being inspected. Cisco Bug IDs: CSCve12652.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6766?
CVE-2017-6766 has been assigned a high severity rating due to its potential to allow unauthorized access.
How do I fix CVE-2017-6766?
To fix CVE-2017-6766, upgrade your Cisco Firepower System Software to a version that is not affected by this vulnerability.
What versions are affected by CVE-2017-6766?
CVE-2017-6766 affects Cisco Firepower System Software versions 5.4.0 through 6.2.2.
What type of attack can exploit CVE-2017-6766?
CVE-2017-6766 can be exploited by unauthenticated, remote attackers to bypass SSL decryption and inspection policies.
Is there a workaround for CVE-2017-6766?
There are no widely recommended workarounds for CVE-2017-6766 aside from upgrading to a patched version.