{ "document": { "acknowledgments": [ { "summary": "This vulnerability was found during the resolution of a Cisco TAC support case." } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "notes": [ { "category": "summary", "title": "Summary", "text": "A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software running on Cisco Firepower Threat Defense (FTD) sensors could allow an authenticated, local attacker to execute specific CLI commands with root privileges on the Cisco Firepower Management Center (FMC), or through Cisco FMC on other Firepower sensors and devices that are controlled by the same Cisco FMC. To send the commands, the attacker must have root privileges for at least one affected sensor or the Cisco FMC.\r\n\r\nThe vulnerability exists because the affected software performs insufficient checks for certain CLI commands, if the commands are executed via a Sourcefire tunnel connection. An attacker could exploit this vulnerability by authenticating with root privileges to a Firepower sensor or Cisco FMC, and then sending specific CLI commands to the Cisco FMC or through the Cisco FMC to another Firepower sensor via the Sourcefire tunnel connection. A successful exploit could allow the attacker to modify device configurations or delete files on the device that is running Cisco FMC Software or on any Firepower device that is managed by Cisco FMC.\r\n\r\nThere are no workarounds that address this vulnerability.\r\n\r\n" }, { "category": "general", "title": "Vulnerable Products", "text": "This vulnerability affects the following Cisco products, if they are running a vulnerable release of Cisco Firepower System Software:\r\n\r\nAdaptive Security Appliance (ASA) 5500-X Series with FirePOWER Services\r\nAdaptive Security Appliance (ASA) 5500-X Series Next-Generation Firewalls\r\nFirePOWER 7000 Series Appliances\r\nFirePOWER 8000 Series Appliances\r\nFirepower 2100 Series Security Appliances\r\nFirepower 4100 Series Security Appliances\r\nFirepower 9300 Series Security Appliances\r\nFirepower Management Center\r\nFirepower Threat Defense\r\nFirepower Threat Defense Virtual (FTDv)\r\nVirtual Next-Generation Intrusion Prevention System (NGIPSv)\r\n\r\nFor information about which Cisco Firepower System Software releases are vulnerable, see the Fixed Software [\"#fs\"] section of this advisory.\r\n\r\nDetermine the Firepower System Software Release\r\n\r\n\r\n\r\nTo determine which Cisco Firepower System Software release is running on a device, administrators can log in to the device, use the show version command in the CLI, and refer to the output of the command. The following example shows the output of the command for a device that is running Cisco Firepower System Software Release 6.2.0:\r\n\r\n\r\n> show version\r\n\r\n\r\n---------------------[ ftd ]---------------------\r\nModel : Cisco ASA5525-X Threat Defense (75) Version 6.2.0 (Build 362)\r\nUUID : 2849ba3c-ecb8-11e6-98ca-b9fc2975893c\r\nRules update version : 2017-03-15-001-vrt\r\nVDB version : 279\r\n---------------------------------------------------" }, { "category": "general", "title": "Products Confirmed Not Vulnerable", "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by this vulnerability.\r\n\r\nCisco has confirmed that this vulnerability does not affect the following Cisco products:\r\n\r\n3000 Series Industrial Security Appliances (ISAs)\r\nAdaptive Security Appliance (ASA) Software\r\nIntrusion Prevention System (IPS) Software" }, { "category": "general", "title": "Details", "text": "Cisco FMC is the management device on the network for Cisco Firepower sensors. Firepower sensors run Cisco Firepower Threat Defense (FTD) Software. For more information about Firepower software and platforms, refer to the Cisco Firepower Compatibility Guide [\"https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html\"].\r\n\r\nThe Sourcefire tunnel control channel protocol is used by Cisco FMC to manage and control Firepower sensors. A Sourcefire tunnel connection, which is a connection that uses this protocol, is used for communication between Cisco FMC and Firepower sensors. Cisco FMC is intended to control Firepower sensors. However, authentication should be required for Firepower sensors to issue commands to Cisco FMC or to other devices that are managed by Cisco FMC. The vulnerability described in this advisory is caused by a lack of authentication." }, { "category": "general", "title": "Workarounds", "text": "There are no workarounds that address this vulnerability." }, { "category": "general", "title": "Fixed Software", "text": "For information about affected and fixed software releases, consult the Cisco bug ID(s) at the top of this advisory.\r\n\r\nWhen considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers." }, { "category": "general", "title": "Vulnerability Policy", "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco." }, { "category": "general", "title": "Exploitation and Public Announcements", "text": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." }, { "category": "general", "title": "Source", "text": "This vulnerability was found during the resolution of a Cisco TAC support case." }, { "category": "legal_disclaimer", "title": "Legal Disclaimer", "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products." } ], "publisher": { "category": "vendor", "contact_details": "psirt@cisco.com", "issuing_authority": "Cisco PSIRT", "name": "Cisco", "namespace": "https://wwww.cisco.com" }, "references": [ { "category": "self", "summary": "Cisco Firepower Management Center and Firepower System Software Sourcefire Tunnel Control Channel Command Execution Vulnerability", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-fp-cmd-injection" }, { "category": "external", "summary": "Cisco Security Vulnerability Policy", "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html" }, { "category": "external", "summary": "Cisco Firepower Compatibility Guide", "url": "https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html" }, { "category": "external", "summary": "Cisco Security Advisories and Alerts page", "url": "https://www.cisco.com/go/psirt" } ], "title": "Cisco Firepower Management Center and Firepower System Software Sourcefire Tunnel Control Channel Command Execution Vulnerability", "tracking": { "current_release_date": "2018-10-03T16:00:00+00:00", "generator": { "date": "2025-10-13T15:35:59+00:00", "engine": { "name": "TVCE" } }, "id": "cisco-sa-20181003-fp-cmd-injection", "initial_release_date": "2018-10-03T16:00:00+00:00", "revision_history": [ { "date": "2018-10-02T16:47:48+00:00", "number": "1.0.0", "summary": "Initial public release." } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "name": "Cisco", "category": "vendor", "branches": [ { "name": "Cisco Firepower System Software", "category": "product_family", "product": { "name": "Cisco Firepower System Software ", "product_id": "CSAFPID-205007" } }, { "name": "Cisco Secure Firewall Management Center (FMC)", "category": "product_family", "branches": [ { "name": "5.4", "category": "product_version", "branches": [ { "name": "Base", "category": "service_pack", "product": { "name": "Base", "product_id": "CSAFPID-212164" } }, { "name": "5.4.1.3", "category": "service_pack", "product": { "name": "5.4.1.3", "product_id": "CSAFPID-212168" } }, { "name": "5.4.1.5", "category": "service_pack", "product": { "name": "5.4.1.5", "product_id": "CSAFPID-213663" } }, { "name": "5.4.1.4", "category": "service_pack", "product": { "name": "5.4.1.4", "product_id": "CSAFPID-213664" } }, { "name": "5.4.1.2", "category": "service_pack", "product": { "name": "5.4.1.2", "product_id": "CSAFPID-213665" } }, { "name": "5.4.1.1", "category": "service_pack", "product": { "name": "5.4.1.1", "product_id": "CSAFPID-213666" } }, { "name": "5.4.1", "category": "service_pack", "product": { "name": "5.4.1", "product_id": "CSAFPID-213667" } }, { "name": "5.4.0", "category": "service_pack", "product": { "name": "5.4.0", "product_id": "CSAFPID-213668" } }, { "name": "5.4.0.2", "category": "service_pack", "product": { "name": "5.4.0.2", "product_id": "CSAFPID-213752" } }, { "name": "5.4.1.6", "category": "service_pack", "product": { "name": "5.4.1.6", "product_id": "CSAFPID-213753" } }, { "name": "5.4.1.9", "category": "service_pack", "product": { "name": "5.4.1.9", "product_id": "CSAFPID-227799" } } ] }, { "name": "6.0", "category": "product_version", "branches": [ { "name": "Base", "category": "service_pack", "product": { "name": "Base", "product_id": "CSAFPID-212170" } }, { "name": "6.0.0", "category": "service_pack", "product": { "name": "6.0.0", "product_id": "CSAFPID-212171" } }, { "name": "6.0.1", "category": "service_pack", "product": { "name": "6.0.1", "product_id": "CSAFPID-212172" } }, { "name": "6.0.0.1", "category": "service_pack", "product": { "name": "6.0.0.1", "product_id": "CSAFPID-213676" } }, { "name": "6.0.0.0", "category": "service_pack", "product": { "name": "6.0.0.0", "product_id": "CSAFPID-213754" } }, { "name": "6.0.1.1", "category": "service_pack", "product": { "name": "6.0.1.1", "product_id": "CSAFPID-222771" } }, { "name": "6.0.1.3", "category": "service_pack", "product": { "name": "6.0.1.3", "product_id": "CSAFPID-227816" } } ] }, { "name": "5.3", "category": "product_version", "branches": [ { "name": "5.3.0.2", "category": "service_pack", "product": { "name": "5.3.0.2", "product_id": "CSAFPID-213670" } }, { "name": "5.3.1.6", "category": "service_pack", "product": { "name": "5.3.1.6", "product_id": "CSAFPID-213671" } }, { "name": "5.3.1.5", "category": "service_pack", "product": { "name": "5.3.1.5", "product_id": "CSAFPID-213672" } }, { "name": "5.3.1.4", "category": "service_pack", "product": { "name": "5.3.1.4", "product_id": "CSAFPID-213673" } }, { "name": "5.3.1.3", "category": "service_pack", "product": { "name": "5.3.1.3", "product_id": "CSAFPID-213674" } }, { "name": "5.3.0.3", "category": "service_pack", "product": { "name": "5.3.0.3", "product_id": "CSAFPID-213675" } }, { "name": "5.3.0", "category": "service_pack", "product": { "name": "5.3.0", "product_id": "CSAFPID-216729" } }, { "name": "5.3.1", "category": "service_pack", "product": { "name": "5.3.1", "product_id": "CSAFPID-216730" } }, { "name": "5.3.0.4", "category": "service_pack", "product": { "name": "5.3.0.4", "product_id": "CSAFPID-217199" } }, { "name": "5.3.1.7", "category": "service_pack", "product": { "name": "5.3.1.7", "product_id": "CSAFPID-227800" } } ] }, { "name": "6.1", "category": "product_version", "branches": [ { "name": "6.1.0", "category": "service_pack", "product": { "name": "6.1.0", "product_id": "CSAFPID-216309" } }, { "name": "6.1.0.2", "category": "service_pack", "product": { "name": "6.1.0.2", "product_id": "CSAFPID-226361" } } ] }, { "name": "6.2", "category": "product_version", "branches": [ { "name": "Base", "category": "service_pack", "product": { "name": "Base", "product_id": "CSAFPID-224893" } }, { "name": "6.2.0", "category": "service_pack", "product": { "name": "6.2.0", "product_id": "CSAFPID-224894" } }, { "name": "6.2.1", "category": "service_pack", "product": { "name": "6.2.1", "product_id": "CSAFPID-225378" } }, { "name": "6.2.2", "category": "service_pack", "product": { "name": "6.2.2", "product_id": "CSAFPID-226362" } }, { "name": "6.2.0.2", "category": "service_pack", "product": { "name": "6.2.0.2", "product_id": "CSAFPID-227815" } } ] } ] } ] } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0453", "ids": [ { "system_name": "Cisco Bug ID", "text": "CSCvg46466" } ], "notes": [ { "category": "other", "title": "Affected Product Comprehensiveness", "text": "Complete." } ], "product_status": { "known_affected": [ "CSAFPID-212164", "CSAFPID-212168", "CSAFPID-212170", "CSAFPID-212171", "CSAFPID-212172", "CSAFPID-213663", "CSAFPID-213664", "CSAFPID-213665", "CSAFPID-213666", "CSAFPID-213667", "CSAFPID-213668", "CSAFPID-213670", "CSAFPID-213671", "CSAFPID-213672", "CSAFPID-213673", "CSAFPID-213674", "CSAFPID-213675", "CSAFPID-213676", "CSAFPID-213752", "CSAFPID-213753", "CSAFPID-213754", "CSAFPID-216309", "CSAFPID-216729", "CSAFPID-216730", "CSAFPID-217199", "CSAFPID-222771", "CSAFPID-224893", "CSAFPID-224894", "CSAFPID-225378", "CSAFPID-226361", "CSAFPID-226362", "CSAFPID-227799", "CSAFPID-227800", "CSAFPID-227815", "CSAFPID-227816", "CSAFPID-205007" ] }, "release_date": "2018-10-03T16:00:00+00:00", "remediations": [ { "category": "vendor_fix", "details": "Cisco has released software updates that address this vulnerability.", "product_ids": [ "CSAFPID-212164", "CSAFPID-212168", "CSAFPID-212170", "CSAFPID-212171", "CSAFPID-212172", "CSAFPID-213663", "CSAFPID-213664", "CSAFPID-213665", "CSAFPID-213666", "CSAFPID-213667", "CSAFPID-213668", "CSAFPID-213670", "CSAFPID-213671", "CSAFPID-213672", "CSAFPID-213673", "CSAFPID-213674", "CSAFPID-213675", "CSAFPID-213676", "CSAFPID-213752", "CSAFPID-213753", "CSAFPID-213754", "CSAFPID-216309", "CSAFPID-216729", "CSAFPID-216730", "CSAFPID-217199", "CSAFPID-222771", "CSAFPID-224893", "CSAFPID-224894", "CSAFPID-225378", "CSAFPID-226361", "CSAFPID-226362", "CSAFPID-227799", "CSAFPID-227800", "CSAFPID-227815", "CSAFPID-227816", "CSAFPID-205007" ], "url": "https://software.cisco.com" } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.0" }, "products": [ "CSAFPID-212164", "CSAFPID-212168", "CSAFPID-212170", "CSAFPID-212171", "CSAFPID-212172", "CSAFPID-213663", "CSAFPID-213664", "CSAFPID-213665", "CSAFPID-213666", "CSAFPID-213667", "CSAFPID-213668", "CSAFPID-213670", "CSAFPID-213671", "CSAFPID-213672", "CSAFPID-213673", "CSAFPID-213674", "CSAFPID-213675", "CSAFPID-213676", "CSAFPID-213752", "CSAFPID-213753", "CSAFPID-213754", "CSAFPID-216309", "CSAFPID-216729", "CSAFPID-216730", "CSAFPID-217199", "CSAFPID-222771", "CSAFPID-224893", "CSAFPID-224894", "CSAFPID-225378", "CSAFPID-226361", "CSAFPID-226362", "CSAFPID-227799", "CSAFPID-227800", "CSAFPID-227815", "CSAFPID-227816" ] } ], "title": "Cisco Firepower Management Center and Firepower System Software Sourcefire Tunnel Control Channel Command Execution Vulnerability" } ] }