CVE-2018-15462: Cisco Firepower Threat Defense Software TCP Ingress Handler Denial of Service Vulnerability
A vulnerability in the TCP ingress handler for the data interfaces that are configured with management access to Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an increase in CPU and memory usage, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient ingress TCP rate limiting for TCP ports 22 (SSH) and 443 (HTTPS). An attacker could exploit this vulnerability by sending a crafted, steady stream of TCP traffic to port 22 or 443 on the data interfaces that are configured with management access to the affected device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Enable/adjust ingress TCP rate limiting on Cisco Firepower Threat Defense (FTD) data interfaces that have management access so that TCP port 22 (SSH) and TCP port 443 (HTTPS) are sufficiently rate-limited to mitigate a crafted steady stream causing CPU/memory exhaustion and DoS.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15462?
CVE-2018-15462 is rated as a high severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2018-15462?
To fix CVE-2018-15462, update Cisco Firepower Threat Defense to a version that is not vulnerable, specifically beyond 6.2.3.12 and 6.3.0.3.
Who is affected by CVE-2018-15462?
CVE-2018-15462 affects users of Cisco Firepower Threat Defense versions up to, but not including, 6.2.3.12 and those in the range of 6.3.0 to 6.3.0.3.
What types of attacks can exploit CVE-2018-15462?
CVE-2018-15462 can be exploited by unauthenticated remote attackers to increase CPU and memory usage.
What are the potential impacts of CVE-2018-15462?
The potential impact of CVE-2018-15462 includes degraded performance and denial of service for affected Cisco Firepower Threat Defense devices.