CVE-2018-0138
First published: Thu Feb 08 2018(Updated: )
A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass file policies that are configured to block files transmitted to an affected device via the BitTorrent protocol. The vulnerability exists because the affected software does not detect BitTorrent handshake messages correctly. An attacker could exploit this vulnerability by sending a crafted BitTorrent connection request to an affected device. A successful exploit could allow the attacker to bypass file policies that are configured to block files transmitted to the affected device via the BitTorrent protocol. Cisco Bug IDs: CSCve26946.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Firepower Threat Defense | =6.1.0 | |
| Cisco Firepower Threat Defense | =6.2.0 | |
| Cisco Firepower Threat Defense | =6.2.2 | |
| Cisco Firepower Threat Defense | =6.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-0138?
CVE-2018-0138 has been classified with a medium severity level.
How do I fix CVE-2018-0138?
To address CVE-2018-0138, you should upgrade the Cisco Firepower Threat Defense to version 6.2.4 or later.
What devices are affected by CVE-2018-0138?
CVE-2018-0138 affects Cisco Firepower Threat Defense versions 6.1.0, 6.2.0, 6.2.2, and 6.2.3.
Can CVE-2018-0138 be exploited remotely?
Yes, CVE-2018-0138 can be exploited by unauthenticated remote attackers.
What type of attack does CVE-2018-0138 enable?
CVE-2018-0138 enables attackers to bypass file policies blocking BitTorrent protocol transmissions.
- agent/type
- agent/references
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco firepower threat defense
- version/cisco firepower threat defense/6.1.0
- version/cisco firepower threat defense/6.2.0
- version/cisco firepower threat defense/6.2.2
- version/cisco firepower threat defense/6.2.3