Cisco Security Advisory
Click Icon to Copy Verbose Score
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X
-
A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software running on Cisco Firepower Threat Defense (FTD) sensors could allow an authenticated, local attacker to execute specific CLI commands with root privileges on the Cisco Firepower Management Center (FMC), or through Cisco FMC on other Firepower sensors and devices that are controlled by the same Cisco FMC. To send the commands, the attacker must have root privileges for at least one affected sensor or the Cisco FMC.
The vulnerability exists because the affected software performs insufficient checks for certain CLI commands, if the commands are executed via a Sourcefire tunnel connection. An attacker could exploit this vulnerability by authenticating with root privileges to a Firepower sensor or Cisco FMC, and then sending specific CLI commands to the Cisco FMC or through the Cisco FMC to another Firepower sensor via the Sourcefire tunnel connection. A successful exploit could allow the attacker to modify device configurations or delete files on the device that is running Cisco FMC Software or on any Firepower device that is managed by Cisco FMC.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-fp-cmd-injection
-
Vulnerable Products
This vulnerability affects the following Cisco products, if they are running a vulnerable release of Cisco Firepower System Software:
- Adaptive Security Appliance (ASA) 5500-X Series with FirePOWER Services
- Adaptive Security Appliance (ASA) 5500-X Series Next-Generation Firewalls
- FirePOWER 7000 Series Appliances
- FirePOWER 8000 Series Appliances
- Firepower 2100 Series Security Appliances
- Firepower 4100 Series Security Appliances
- Firepower 9300 Series Security Appliances
- Firepower Management Center
- Firepower Threat Defense
- Firepower Threat Defense Virtual (FTDv)
- Virtual Next-Generation Intrusion Prevention System (NGIPSv)
For information about which Cisco Firepower System Software releases are vulnerable, see the Fixed Software section of this advisory.
Determine the Firepower System Software Release
To determine which Cisco Firepower System Software release is running on a device, administrators can log in to the device, use the show version command in the CLI, and refer to the output of the command. The following example shows the output of the command for a device that is running Cisco Firepower System Software Release 6.2.0:
> show version---------------------[ ftd ]---------------------
Model : Cisco ASA5525-X Threat Defense (75) Version 6.2.0 (Build 362)
UUID : 2849ba3c-ecb8-11e6-98ca-b9fc2975893c
Rules update version : 2017-03-15-001-vrt
VDB version : 279
---------------------------------------------------Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect the following Cisco products:
- 3000 Series Industrial Security Appliances (ISAs)
- Adaptive Security Appliance (ASA) Software
- Intrusion Prevention System (IPS) Software
-
Cisco FMC is the management device on the network for Cisco Firepower sensors. Firepower sensors run Cisco Firepower Threat Defense (FTD) Software. For more information about Firepower software and platforms, refer to the Cisco Firepower Compatibility Guide.
The Sourcefire tunnel control channel protocol is used by Cisco FMC to manage and control Firepower sensors. A Sourcefire tunnel connection, which is a connection that uses this protocol, is used for communication between Cisco FMC and Firepower sensors. Cisco FMC is intended to control Firepower sensors. However, authentication should be required for Firepower sensors to issue commands to Cisco FMC or to other devices that are managed by Cisco FMC. The vulnerability described in this advisory is caused by a lack of authentication.
-
For information about affected and fixed software releases, consult the Cisco bug ID(s) at the top of this advisory.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
-
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
-
This vulnerability was found during the resolution of a Cisco TAC support case.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show LessVersion Description Section Status Date 1.0 Initial public release. — Final 2018-October-03
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.