cisco-sa-20180711-firesight-file-bypass: Cisco FireSIGHT System Software File Policy Bypass Vulnerability
First published: Wed Jul 11 2018(Updated: )
A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a file policy that is configured to block the transfer of files to an affected system via FTP. The vulnerability exists because the affected software incorrectly handles FTP control connections. An attacker could exploit this vulnerability by sending a maliciously crafted FTP connection to transfer a file to an affected device. A successful exploit could allow the attacker to bypass a file policy that is configured to apply the Block upload with reset action to FTP traffic. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-firesight-file-bypass
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Firesight System |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20180711-firesight-file-bypass?
The severity of cisco-sa-20180711-firesight-file-bypass is categorized as high due to the potential for unauthenticated remote attackers to bypass file transfer policies.
How do I fix cisco-sa-20180711-firesight-file-bypass?
To fix cisco-sa-20180711-firesight-file-bypass, upgrade to the latest version of Cisco FireSIGHT System Software that addresses this vulnerability.
What types of attacks can exploit cisco-sa-20180711-firesight-file-bypass?
cisco-sa-20180711-firesight-file-bypass can be exploited to allow unauthorized file transfers via FTP to the affected system.
What systems are affected by cisco-sa-20180711-firesight-file-bypass?
The systems affected by cisco-sa-20180711-firesight-file-bypass include those running Cisco FireSIGHT System Software.
Is authentication needed to exploit cisco-sa-20180711-firesight-file-bypass?
No authentication is required to exploit cisco-sa-20180711-firesight-file-bypass, making it particularly dangerous.
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/weakness
- agent/title
- agent/severity
- agent/references
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco firesight system