Vulnerability Name:

CVE-2018-0233 (CCN-141820)

Assigned:2017-11-27
Published:2018-04-18
Updated:2019-10-09
Summary:A vulnerability in the Secure Sockets Layer (SSL) packet reassembly functionality of the detection engine in Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause the detection engine to consume excessive system memory on an affected device, which could cause a denial of service (DoS) condition. The vulnerability is due to the affected software improperly handling changes to SSL connection states. An attacker could exploit this vulnerability by sending crafted SSL connections through an affected device. A successful exploit could allow the attacker to cause the detection engine to consume excessive system memory on the affected device, which could cause a DoS condition. The device may need to be reloaded manually to recover from this condition. This vulnerability affects Cisco Firepower System Software Releases 6.0.0 and later, running on any of the following Cisco products: Adaptive Security Appliance (ASA) 5500-X Series Firewalls with FirePOWER Services, Adaptive Security Appliance (ASA) 5500-X Series Next-Generation Firewalls, Advanced Malware Protection (AMP) for Networks, 7000 Series Appliances, Advanced Malware Protection (AMP) for Networks, 8000 Series Appliances, Firepower 4100 Series Appliances, FirePOWER 7000 Series Appliances, FirePOWER 8000 Series Appliances, Firepower 9300 Series Security Appliances, Firepower Threat Defense for Integrated Services Routers (ISRs), Firepower Threat Defense Virtual for VMware, Industrial Security Appliance 3000, Sourcefire 3D System Appliances. Cisco Bug IDs: CSCve23031.
CVSS v3 Severity:8.6 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
7.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
8.6 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
7.5 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-400
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2018-0233

Source: BID
Type: Third Party Advisory, VDB Entry
103930

Source: CCN
Type: BID-103930
Cisco Firepower System Software CVE-2018-0233 Denial of Service Vulnerability

Source: XF
Type: UNKNOWN
cisco-fpsnort-cve20180233-dos(141820)

Source: CCN
Type: Cisco Security Advisory cisco-sa-20180418-fpsnort
Cisco Firepower Detection Engine Secure Sockets Layer Denial of Service Vulnerability

Source: CONFIRM
Type: Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fpsnort

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cisco:firepower_management_center:5.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:firepower_management_center:6.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:firepower_management_center:6.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:firepower_management_center:6.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:firepower_management_center:6.2.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:cisco:firepower_system_software:6.2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    cisco firepower management center 5.4.0
    cisco firepower management center 6.0.0
    cisco firepower management center 6.1.0
    cisco firepower management center 6.2.0
    cisco firepower management center 6.2.1
    cisco firepower system software 6.2.0