BDU:2024-08896

Опубликовано: 23 окт. 2024

Источник: fstec

CVSS3: 5.8

CVSS2: 5

EPSS Низкий

Описание

Уязвимость функции TCP Intercept и системы обнаружения вторжений Snort микропрограммного обеспечения межсетевых экранов Cisco Firepower Threat Defense (FTD) связана с ошибками управления ресурсами в результате некорректно настроенного значения Maximum Embryonic TCP-соединений. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, обойти ограничения безопасности и выполнить атаку SYN flood

Вендор

Cisco Systems Inc.

Наименование ПО

Firepower Threat Defense

Версия ПО

6.2.3 (Firepower Threat Defense)

6.4.0 (Firepower Threat Defense)

6.2.3.16 (Firepower Threat Defense)

7.0.0 (Firepower Threat Defense)

7.2.0 (Firepower Threat Defense)

7.2.0.1 (Firepower Threat Defense)

6.6.0 (Firepower Threat Defense)

6.6.0.1 (Firepower Threat Defense)

6.6.1 (Firepower Threat Defense)

6.6.3 (Firepower Threat Defense)

6.6.4 (Firepower Threat Defense)

6.6.5 (Firepower Threat Defense)

6.6.5.1 (Firepower Threat Defense)

6.6.5.2 (Firepower Threat Defense)

7.0.0.1 (Firepower Threat Defense)

7.0.1 (Firepower Threat Defense)

7.0.1.1 (Firepower Threat Defense)

7.0.2 (Firepower Threat Defense)

7.0.2.1 (Firepower Threat Defense)

7.0.3 (Firepower Threat Defense)

7.0.4 (Firepower Threat Defense)

7.1.0.1 (Firepower Threat Defense)

7.1.0.2 (Firepower Threat Defense)

6.6.7 (Firepower Threat Defense)

7.0.5 (Firepower Threat Defense)

7.1.0.3 (Firepower Threat Defense)

7.2.1 (Firepower Threat Defense)

7.2.2 (Firepower Threat Defense)

7.2.3 (Firepower Threat Defense)

7.3.0 (Firepower Threat Defense)

7.3.1 (Firepower Threat Defense)

7.3.1.1 (Firepower Threat Defense)

7.2.4 (Firepower Threat Defense)

6.2.3.3 (Firepower Threat Defense)

6.2.3.4 (Firepower Threat Defense)

6.2.3.5 (Firepower Threat Defense)

6.2.3.6 (Firepower Threat Defense)

6.2.3.7 (Firepower Threat Defense)

6.2.3.8 (Firepower Threat Defense)

6.2.3.9 (Firepower Threat Defense)

6.2.3.10 (Firepower Threat Defense)

6.2.3.11 (Firepower Threat Defense)

6.2.3.12 (Firepower Threat Defense)

6.2.3.13 (Firepower Threat Defense)

6.2.3.14 (Firepower Threat Defense)

6.2.3.15 (Firepower Threat Defense)

6.2.3.17 (Firepower Threat Defense)

6.2.3.18 (Firepower Threat Defense)

6.4.0.1 (Firepower Threat Defense)

6.4.0.2 (Firepower Threat Defense)

6.4.0.3 (Firepower Threat Defense)

6.4.0.4 (Firepower Threat Defense)

6.4.0.5 (Firepower Threat Defense)

6.4.0.6 (Firepower Threat Defense)

6.4.0.7 (Firepower Threat Defense)

6.4.0.8 (Firepower Threat Defense)

6.4.0.9 (Firepower Threat Defense)

6.4.0.10 (Firepower Threat Defense)

6.4.0.11 (Firepower Threat Defense)

6.4.0.12 (Firepower Threat Defense)

6.4.0.13 (Firepower Threat Defense)

6.4.0.14 (Firepower Threat Defense)

6.4.0.15 (Firepower Threat Defense)

6.4.0.16 (Firepower Threat Defense)

6.6.7.1 (Firepower Threat Defense)

6.7.0 (Firepower Threat Defense)

6.7.0.1 (Firepower Threat Defense)

6.7.0.2 (Firepower Threat Defense)

6.7.0.3 (Firepower Threat Defense)

7.1.0 (Firepower Threat Defense)

6.2.3.1 (Firepower Threat Defense)

6.2.3.2 (Firepower Threat Defense)

7.0.6 (Firepower Threat Defense)

7.2.4.1 (Firepower Threat Defense)

7.2.5 (Firepower Threat Defense)

6.4.0.17 (Firepower Threat Defense)

7.0.6.1 (Firepower Threat Defense)

7.2.5.1 (Firepower Threat Defense)

7.4.0 (Firepower Threat Defense)

7.4.1 (Firepower Threat Defense)

7.3.1.2 (Firepower Threat Defense)

6.6.7.2 (Firepower Threat Defense)

7.0.6.2 (Firepower Threat Defense)

7.2.5.2 (Firepower Threat Defense)

7.2.8.1 (Firepower Threat Defense)

7.4.1.1 (Firepower Threat Defense)

6.4.0.18 (Firepower Threat Defense)

7.2.6 (Firepower Threat Defense)

7.2.7 (Firepower Threat Defense)

7.2.8 (Firepower Threat Defense)

Тип ПО

ПО программно-аппаратного средства

Операционные системы и аппаратные платформы

Cisco Systems Inc. - -

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 5)

Средний уровень опасности (базовая оценка CVSS 3.0 составляет 5,8)

Возможные меры по устранению уязвимости

Использование рекомендаций:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-bypass-PTry37fX

Компенсирующие меры:

Рекомендуется отключить конфигурацию pkt-decode-optimization с помощью команды asp inspect-dp pkt-decode-optimization в интерфейсе командой строки:

FTD# no asp inspect-dp pkt-decode-optimization

FTD#

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Ссылки на источники

Идентификаторы других систем описаний уязвимостей

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-20407
CVE

EPSS

Процентиль: 42%

0.00198

Низкий

5.8 Medium

CVSS3

5 Medium

CVSS2

Связанные уязвимости

CVE-2024-20407

CVSS3: 5.8

nvd

больше 1 года назад

A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies on an affected system. Devices that are configured with Snort 2 are not affected by this vulnerability. This vulnerability is due to a logic error when handling embryonic (half-open) TCP connections. An attacker could exploit this vulnerability by sending a crafted traffic pattern through an affected device. A successful exploit could allow unintended traffic to enter the network protected by the affected device.

GHSA-6vh9-9qf6-mvjj

CVSS3: 5.8

github

больше 1 года назад

EPSS

Процентиль: 42%

0.00198

Низкий

5.8 Medium

CVSS3

5 Medium

CVSS2