cisco-sa-20180711-firesight-file-bypass: Cisco FireSIGHT System Software File Policy Bypass Vulnerability
A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a file policy that is configured to block the transfer of files to an affected system via FTP.
The vulnerability exists because the affected software incorrectly handles FTP control connections. An attacker could exploit this vulnerability by sending a maliciously crafted FTP connection to transfer a file to an affected device. A successful exploit could allow the attacker to bypass a file policy that is configured to apply the Block upload with reset action to FTP traffic. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-firesight-file-bypass
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20180711-firesight-file-bypass?
The severity of cisco-sa-20180711-firesight-file-bypass is categorized as high due to the potential for unauthenticated remote attackers to bypass file transfer policies.
How do I fix cisco-sa-20180711-firesight-file-bypass?
To fix cisco-sa-20180711-firesight-file-bypass, upgrade to the latest version of Cisco FireSIGHT System Software that addresses this vulnerability.
What types of attacks can exploit cisco-sa-20180711-firesight-file-bypass?
cisco-sa-20180711-firesight-file-bypass can be exploited to allow unauthorized file transfers via FTP to the affected system.
What systems are affected by cisco-sa-20180711-firesight-file-bypass?
The systems affected by cisco-sa-20180711-firesight-file-bypass include those running Cisco FireSIGHT System Software.
Is authentication needed to exploit cisco-sa-20180711-firesight-file-bypass?
No authentication is required to exploit cisco-sa-20180711-firesight-file-bypass, making it particularly dangerous.