Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability
Cisco fixed an SSL certificate parsing flaw in FTD's Snort 2 engine letting unauthenticated remote attackers force detection engine restarts.
Incomplete validation of SSL certificates in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense software allows an unauthenticated, remote attacker to send a crafted SSL connection setup request for parsing. A successful exploit restarts the Snort 2 Detection Engine unexpectedly, causing a denial of service. Cisco has released software updates, and no workarounds address the vulnerability.
- Incomplete SSL certificate validation affects the Snort 2 Detection Engine
- Crafted SSL connection setup request triggers detection engine restart
- Causes denial of service on Cisco FTD deployments
- Software updates released; no workarounds available
From the original article
A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the Snort 2 Detection Engine to restart. This vulnerability is due to incomplete validation of the SSL certificate.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.