Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2019-04680

Опубликовано: 18 апр. 2019
Источник: fstec
CVSS3: 8.6
CVSS2: 10
EPSS Низкий

Описание

Уязвимость функции повторной сборки пакетов модуля Secure Sockets Layer (SSL) системы предотвращения вторжений Cisco Firepower System Software с неконтролируемым расходом ресурсов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать отказ в обслуживании

Вендор

Cisco Systems Inc.

Наименование ПО

Firepower System Software

Версия ПО

6.1.0 (Firepower System Software)
6.2.0 (Firepower System Software)
6.2.1 (Firepower System Software)
5.4.0 (Firepower System Software)
6.0.0 (Firepower System Software)

Тип ПО

Сетевое программное средство

Операционные системы и аппаратные платформы

-

Уровень опасности уязвимости

Критический уровень опасности (базовая оценка CVSS 2.0 составляет 10)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 8,6)

Возможные меры по устранению уязвимости

Использование рекомендаций:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fpsnort

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 65%
0.00484
Низкий

8.6 High

CVSS3

10 Critical

CVSS2

Связанные уязвимости

CVSS3: 8.6
nvd
почти 8 лет назад

A vulnerability in the Secure Sockets Layer (SSL) packet reassembly functionality of the detection engine in Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause the detection engine to consume excessive system memory on an affected device, which could cause a denial of service (DoS) condition. The vulnerability is due to the affected software improperly handling changes to SSL connection states. An attacker could exploit this vulnerability by sending crafted SSL connections through an affected device. A successful exploit could allow the attacker to cause the detection engine to consume excessive system memory on the affected device, which could cause a DoS condition. The device may need to be reloaded manually to recover from this condition. This vulnerability affects Cisco Firepower System Software Releases 6.0.0 and later, running on any of the following Cisco products: Adaptive Security Appliance (ASA) 5500-X Series Firewalls with FirePOWER Serv

CVSS3: 8.6
github
больше 3 лет назад

A vulnerability in the Secure Sockets Layer (SSL) packet reassembly functionality of the detection engine in Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause the detection engine to consume excessive system memory on an affected device, which could cause a denial of service (DoS) condition. The vulnerability is due to the affected software improperly handling changes to SSL connection states. An attacker could exploit this vulnerability by sending crafted SSL connections through an affected device. A successful exploit could allow the attacker to cause the detection engine to consume excessive system memory on the affected device, which could cause a DoS condition. The device may need to be reloaded manually to recover from this condition. This vulnerability affects Cisco Firepower System Software Releases 6.0.0 and later, running on any of the following Cisco products: Adaptive Security Appliance (ASA) 5500-X Series Firewalls with FirePOWER S...

EPSS

Процентиль: 65%
0.00484
Низкий

8.6 High

CVSS3

10 Critical

CVSS2