CSCuw70987, CSCux50957, CSCux86317
|
Resolved multiple vulnerabilities within the third party Open SSH, as described in CVE-2015-5600, CVE-2015-6565, CVE-2016-0777, and CVE-2016-0778.
|
CSCuw88390, CSCuw88396, CSCuw89094
|
Addressed a cross-site scripting (XSS) vulnerability, as described in CVE-2015-6363 and CVE-2016-1294.
|
CSCux41304, CSCuz52366, CSCvb24543, CSCvb48536
|
Addressed multiple vulnerabilities that generated denial of service in OpenSSL, as described in CVE-2015-3194, CVE-2015-3195, CVE-2015-3196, CVE-2016-2105, CVE-2016-2106 CVE-2016-2107, CVE-2016-2108, CVE-2016-2109, CVE-2016-2176, CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305, CVE-2016-6306 CVE-2016-6307 CVE-2016-6308 CVE-2016-6309 CVE-2016-7052 CVE-2015-3194, CVE-2015-3195 and CVE-2015-3196.
|
CSCux42288
|
Addressed a vulnerability issue in the third party Java, as described in CVE-2015-6420.
|
CSCux90163
|
Resolved a vulnerability where a user without Admin without privileges could delete other users' scheduled tasks.
|
CSCuy32284
|
Addressed a vulnerability in the third party GNU C Library, as described in CVE-2015-7547.
|
CSCuz52939, CSCvb24561, CSCvb24562
|
Addressed multiple vulnerabilities in the third party product Libxml2, as described in CVE-2016-2073, CVE-2016-444, and CVE-2016-4448.
|
CSCuz92632
|
Addressed multiple vulnerabilities in the third party product NTP, as described in CVE-2016-4953, CVE-2016-4954, CVE-2016-4955, CVE-2016-4956, and CVE-2016-4957.
|
CSCvb24566, CSCvb24564
CSCuz52935
|
Address multiple vulnerabilities in the Libarchive, as described in CVE-2016-1541, CVE-2016-5844, and CVE-2016-6250.
|
CSCuu96447
|
In some cases, if you deleted the permanent license from the Licenses page , the Device Management page did not display Unlicensed for devices the permanent license was deleted from when it should have, and policy deploy would fail.
|
CSCux64898
|
In some cases, if you deployed an access control policy with the default action set to Block and executed the configure network management-interface disable-event-channel CLI command, Firepower continued to generate intrusion and connection events when it should not have.
|
CSCux78211
|
Resolved an issue where, if an ASA FirePOWER module in high availability experienced a partial failure, the device did not failover when it should have.
|
CSCux91934
|
Resolved an issue where, if you deployed an SSL policy configured with a rule associated with an expired SSL certificate, Firepower used an incorrect SSL rule.
|
CSCuy28088
|
Cannot apply FP8130-CTRL-LIC to AMP8050.
|
CSCuy49371
|
If you clicked Create Email Alert on the Alerts page and enabled Retrospective Events configuration on the Advanced Malware Protection Alerts tab, then saved and applied, the email alerts generated by Firepower when the alert was triggered were truncated. Emails should not have been truncated.
|
CSCuy51566
|
If you updated a Firepower Management
Center from Version 5.4.x to Version 6.0.0 or later and created a new sub domain and deployed a network discovery policy, you could not delete any objects or object groups referenced by the network discovery policy in the global domain.
|
CSCuy57756
|
In some cases, if you broke a Firepower Threat Defense high availability pair, one of the devices in the pair stayed in standalone mode and Firepower could not recreate the high availability pair.
|
CSCuy67210
|
Not able to disable notifications on the Firesight manager Web interface.
|
CSCuy68648
|
Resolved an issue where, if you added a security zone on a Firepower Management
Center running Version 5.4.0 or later and updated Firepower to Version 6.0.0 or later and deleted the security zone, Firepower generated an Object deletion restricted. Remove object from the following: Access control policies error even if the security zone was not referenced within a rule.
|
CSCuy83201
|
Fatal errors on applying policy from 6.0.0.1 with different vulnerability database.
|
CSCuz17315
|
Resolved an issue where Firepower generated erroneous Error found during SSL flow after server certificate messages for evicted SSL flows.
|
CSCuz17723
|
Firepower 9300 devices' high availability status is displayed incorrectly/inconsistent in the Firepower Management
Center.
|
CSCuz24872
|
Original Client IP does not populate for dropped events when inline normalization enabled.
|
CSCuz46366
|
Firepower incorrectly allowed you configure sandbox file sizes from 0 MB to 100 MB on the Files and Malware Settings section on the Advanced tab of the access control editor. Firepower only supports capturing files as large as 10 MB. If you configured the sandbox environment to a file size larger than 10 MB, Firepower did not capture the file.
|
CSCuz49023
|
Resolved an issue where despite configuration of impact flag alerting for an eStreamer client, Firepower did not stream impact flag data.
|
CSCuz54417
|
If you deployed an SSL policy containing application rule conditions for SMTPS, POP3S, and IMAPS traffic, Firepower might have incorrectly displayed Unknown as the application protocol in the Connection Events page .
|
CSCuz78239
|
DLL-Load vulnerability in Snort on Windows platforms.
|
CSCuz92255
|
Resolved an issue where, if you tested the default storage type on the Remote Stage Device section of the Configuration page , Firepower incorrectly generated a Please enter valid host. Please enter a valid Directory path. error message.
|
CSCuz92983
|
Policy deployment fails with mode 10 Gbit Full-Duplex for lag interface.
|
CSCuz94444
|
Resolved an issue where the associated client incorrectly rejected resigned certificates for Apple related products and you could not log into iTunes.
|
CSCuz95008
|
Resolved an issue where, if you requested pre 6.0.0 metadata from a Firepower Management
Center with eStreamer running Version 6.0.0. or later, Firepower incorrectly sent the userID field to the eStreamer client instead of the configured LDAP username.
|
CSCuz99677
|
Resolved an issue where, if you created a new user with an administrator role and deployed configuration, Firepower incorrectly displayed the default admin user as the user deploying the configuration instead of the newly created user.
|
CSCva00234
|
Resolved an issue where policy comparison did not include the high availability health modules when it should have.
|
CSCva01674
|
sfestreamer crashes when we have 4 management interfaces on Firepower Management
Center.
|
CSCva12481
|
Disk manager marks conn-unified as deleted.
|
CSCva28854
|
Under rare conditions, when 7000
and 8000 Series devices where firstboot policy apply failed, file handles are depleted on the device which caused health/hardware alarms and a variety of malfunctions.
|
CSCva29636
|
Resolved an issue where, if you configure network management for a Firepower Threat Defense virtual device, the console incorrectly provided an HTTPS address to complete the installation when it should not have.
|
CSCva37443
|
If your ASA configuration file contained an invalid ICMP service object, the ASA-to-Firepower Threat Defense migration tool failed, but did not log adequate information to troubleshooting logs. Migration no longer fails under this condition. Instead, the tool excludes the invalid ICMP objects from the conversion, converts the related ASA access rules to disabled Firepower Threat Defense rules, and adds a comment to the rules describing the unsupported case.
|
CSCva38608
|
Resolved an issue where SHA1 signed certificate with a modern browser and Firepower generated untrusted certificate errors for modern browser.
|
CSCva41164
|
Version 6.2.0 does not support access control policy names including the $ character.
|
CSCva47456
|
Resolved an issue where, if Firepower requested a URL lookup and the cloud did not immediately return a URL category, the cached request incorrectly remained marked as Pending instead of updating the URL type to Uncategorzied.
|
CSCva49869
|
Report generation did not give a failed message, continues in queue for week.
|
CSCva51022
|
If you deployed a pair of network object groups to a Firepower Threat Defense high availability pair and the network object group IP addresses on either the active and standby device overlapped with the IP addresses on the other device within the pair, deployment failed and Firepower generated a Deployment failed due to configuration error message in the Message Center.
|
CSCva51662
|
Resolved an issue where, if you clicked Launch Readiness Check while another readiness check is in the queue and closed the dialog window, Firepower incorrectly started a new readiness check task .
|
CSCva57174
|
On a Firepower Threat Defense Virtual with RIP and redistribution configured, even if you disabled RIP and redeployed, the device continued to use RIP.
|
CSCva58269
|
Resolved an issue where, if you created alerts associated with a domain and then deleted the domain, Firepower did not remove the alerts from the database when it should have.
|
CSCva58393
|
User is able to apply smart licenses on AWS HB device.
|
CSCva58411
|
Resolved an issue where, if you added smart licenses to a Firepower Threat Defense high availability pair, the smart licensing widget on the dashboard page did not load.
|
CSCva59135
|
The ASA-to-Firepower Threat Defense migration tool can convert only one ASA configuration file at a time. If you started a conversion while a conversion task was in progress, Firepower displayed an Error 500 Internal server error message. Firepower now displays a warning message that a migration is already in progress.
|
CSCva63604
|
Resolved an issue where, if a security module on a Firepower Threat Defense cluster with an access control policy containing more than 10,000 rules reloaded, the security module failed to re-join the cluster and generated a All data interfaces have been shutdown due to clustering being disabled. To recover either enable clustering or remove cluster group configuration warning.
|
CSCva67943
|
Resolved an issue where, if you enabled common criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate did not contain serverAuth, Firepower incorrectly passed connections to the syslog server when they should have failed.
|
CSCva72899
|
Access control policy report fails if category has span across 50 rules.
|
CSCva81548
|
Improved configuration deployment performance.
|
CSCva82945
|
The Interfaces tab of the device management page for a Firepower Threat Defense device now displays the current status for interfaces on the device.
|
CSCva89328
|
Resolved an issue where, if you deployed an intrusion rule containing an AppID web application condition and a managed device experienced a high volume of traffic containing an excessive amount of similar connection types that did not apply to the AppID application, the application detection process took more time than it normally should and caused latency for other traffic matches.
|
CSCva89342
|
If you created an ASA Firepower module high available pair configured for multi-context mode and deployed one or more security zone from the managing Firepower Management Center, then the standby ASA Firepower module within the pair restarted, the standby ASA Firepower module incorrectly removed all security zones and interfaces.
|
CSCva93408, CSCva93158
|
Improved the RPC decoder.
|
CSCva99998
|
Resolved an issue where Firepower did not restrict read-only users from editing the blacklist page when it should have.
|
CSCvb02417
|
Adaptive profiling performance scales badly in some cases.
|
CSCvb02846
|
Resolved a rare issue where, if you switched Firepower Management
Center high availability peers twice and viewed the Smart Licenses page , the table of devices and any edit windows failed to load.
|
CSCvb05694
|
Resolved an issue where, if you deployed an SSL policy and traffic with an HTTP tunnel matched the SSL policy, Firepower dropped some traffic and experienced high CPU use and overall latency.
|
CSCvb08840
|
Resolved an issue where, if you enabled automated intrusion rule updates for an ASA Firepower module managed by ASDM, and the device simultaneously deployed automated deployments, the device experienced issues.
|
CSCvb11574
|
Resolved an issue where, if you deployed an access control policy containing a custom application detector and deleted the application detector, Firepower did not generate a warning that the application detector must be removed from the access control policy prior to deletion.
|
CSCvb11642
|
Resolved an issue where, if you created a network discovery policy configured to detect hosts and a correlation policy containing a rule set to trigger if discovery event occurs and the OS information for a host has changed, then added a condition for if OS name is unknown and added a remediation Nmap scan, discovery events matching the rules did not generated corresponding Nmap scans.
|
CSCvb11931
|
Resolved an issue where, if Firepower experienced an issue processing the first session of SMTP traffic between a client and an SMTP server, Firepower did not correctly identify the subsequent SMTP sessions as SMTP for the client-server pair and displayed Unknown in the Application Protocol column of the Connection Events page .
|
CSCvb12453
|
Resolved an issue where, if you enabled common criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate did not contain host name matching the name of the server, connections to the syslog server incorrectly passed when they should have failed.
|
CSCvb12791
|
Resolved an issue where, if you enabled Common Criteria (CC) mode on an appliance for security certifications compliance and the syslog server certificate and/or intermediate certificate(s) have been revoked, Firepower incorrectly established a TLS connection with the syslog server without checking the revocation status.
|
CSCvb14402
|
Traffic by Initiator Report for User Renders No Output.
|
CSCvb19366
|
Cisco Firepower Management
Center Information Disclosure Vulnerability.
|
CSCvb19716
|
Resolved an issue where Firepower Management
Center high availability synchronization failed if the total size of the database files and logs totaled more than 4GB.
|
CSCvb20859
|
Intermittently, if the ASA-to-Firepower Threat Defense migration tool could not migrate an ASA configuration because the access control list was not applied via a valid access-group command, Firepower did not complete internal operations related to that migration, and you could not start another migration.
|
CSCvb24378
|
You can now enable or disable default inspection with the command line interface on a Firepower Threat Defense device using configure inspection <inspection_name> enable|disable.
|
CSCvb24768
|
Resolved an issue where, in some cases, if you updated a system containing at least one security zone to Version 6.1 or later, the Interfaces page might incorrectly displayed the security zone state as Unknown .
|
CSCvb24807
|
In rare cases, after you updated the Firepower Management
Center to Version 6.10, the dynamic analysis page would not load.
|
CSCvb25963
|
Resolved an issue where, if you formed a Firepower 4100 series series or Firepower 9300 high availability pair with devices containing named interfaces and assigned a portchannel from the FXOS chassis manager, then edited the Interfaces tab of the high availability pair listed on the Device Management page and saved, Firepower did not include the interfaces created for the high availability pair when it should and, in some cases, deployment failed.
|
CSCvb26266
|
Resolved an issue where, if you enabled captive portal on a system and updated to Version 6.1.0, captive portal did not work.
|
CSCvb28158
|
Workflow set with User Preferences not honored by Search Constraints.
|
CSCvb28202
|
False warnings in database Integrity Check for PlatformSettings object.
|
CSCvb32484
|
Upgrade to 6.1 fails at 600_schema/000_install_csm.sh.
|
CSCvb32873
|
Cannot create new Application Filter Objects 6.1 on ASA managed by ASDM.
|
CSCvb35499
|
Resolved an issue where, in some cases, if you updated a system from Version 6.1.0 to Version 6.1.0.x, the update failed.
|
CSCvb35861
|
Resolved an issue where, if you created a high availability pair and synchronization requests overload the Tasks tab in the Message Center, Firepower experienced disk space issues and intermittent login issues.
|
CSCvb36645
|
Resolved an issue where, if incoming HTTP, TCP, or SSH traffic did not contain an SGT value in the header, traffic matched against the default access control policy instead of any other configured policy.
|
CSCvb36847
|
Event QoS in legacy mode does not have an entry for interface stats.
|
CSCvb39325
|
Resolved an issue where incoming HTTP and HTTPS traffic containing XFF fields caused system issues.
|
CSCvb39435
|
If you updated Firepower from a version earlier than Version 6.1.0 to Version 6.1.0 and immediately exported the access control policy, then imported the policy, importing the access control policy failed.
|
CSCvb40344
|
If you deployed a file policy to a device with an excessive amount of endpoints configured, Firepower experienced high CPU and memory use. As a workaround, you could redeploy configuration.
|
CSCvb41047
|
Resolved an issue where Firepower generated an incorrect Health monitoring running behind schedule health warning if the Firepower Management
Center did not receive any health events from registered devices.
|
CSCvb42559
|
Firepower Management
Center Smart Licensing bypasses Proxy Configuration when in evaluation mode.
|
CSCvb43868
|
Upgrade failing for v6.0.1 at 600_schema/000_install_csm.sh.
|
CSCvb44812
|
Resolved an issue where Firepower 4100 series series devices generated excessive logging and experienced storage space issues.
|
CSCvb44268
|
Resolved an issue where the Appliance Status widget did not load if you had 400 or more devices attached to a Firepower Management
Center.
|
CSCvb46146
|
If updating Firepower failed and you attempted to update to a different version from the one that failed without resolving the original failure, the new install also failed and could cause Firepower to become unrecoverable.
|
CSCvb46555
|
Resolved an issue where, if you enabled Safe Search in an access control policy and deployed, Firepower incorrectly generated Primary Detection Engine Exiting health alerts.
|
CSCvb47847
|
Resolved an issue where, if you updated a system from Version 6.0.1.1 or later to Version 6.1.0, Firepower experienced a variety of issues such as update failure or Firepower Management
Center login failure.
|
CSCvb51077
|
Resolved an issue where, if you added a remediation as a response to a rule in a correlation policy on a Firepower Management
Center and created a high availability pair, then switch high availability peers, the new active Firepower Management
Center did not correctly synchronize the correlation policy and the remediation experienced issues.
|
CSCvb52057
|
Resolved an issue where, if you deployed an access control policy containing rules with Safe Search enabled, some websites experienced latency when loading.
|
CSCvb57521
|
Firepower Management
Center/Firepower Threat Defense - Multiple default routes with same metric or gateway exists.
|
CSCvb57747
|
Deploy during intrusion rule update install may cause all subsequent policy applies to fail.
|
CSCvb60088
|
Firepower Threat Defense policy deployment fails with Syslog Event class All.
|
CSCvb61055
|
Security Intelligence synchronization failure results in disk becoming full.
|
CSCvb61156
|
Resolved an issue where, if a Firepower Management
Center running Version 6.1.0 managed a device running a version earlier than Version 6.1.0, Firepower did not generate any new discovery events and removed the network map several days after the Firepower Management
Center updated to Version 6.1.0.
|
CSCvb61480
|
In some cases, if Firepower processed SIP packets, traffic containing voice or video content might have appeared distorted or experienced latency.
|
CSCvb61836
|
Resolved an issue where Firepower logged extraneous policy information during deployment and, in some cases, deploying large policies failed.
|
CSCvb65648
|
Resolved an issue where, if you deployed an access control policy containing an identity policy that referenced a realm or access control rules containing groups or users from the realm and you deleted the realm, Firepower incorrectly generated a System defined Objects cannot be Altered. Please use a different Object error and you could not edit the access control policy.
|
CSCvb66591
|
If you configured a realm for an Active Directory (AD) server to download users and groups, then created a Firepower Management
Center high availability pair and the downloads contained large amounts of users and groups, Firepower Management
Center high availability registration failed.
|
CSCvb67568
|
Resolved a rare issue where, if you created a realm and deployed an access control policy containing rules, then clicked Download users and groups and configured a User Agent connection, the user to group mapping became incorrect and access control rules using groups did not match when it should.
|
CSCvb68226
|
SFR upgrade to 6.1 causes constant failover between ASA FirePOWER module high availability pair.
|
CSCvb69742
|
6.0.0 pre install 5.4.0.999 nfp kernel modules fail to unload followed by outage.
|
CSCvb69906
|
Intermittently, if you created a realm and deployed an access control policy containing rules, then downloaded users and groups (including scheduled downloads), the user-to-group mapping could become incorrect, and access control rules using groups might not have matched when they should have.
|
CSCvb70125
|
Resolved an issue where policy deploy failed if you configured captive portal on a Firepower Management
Center then updated the Firepower Management
Center and its managed devices, then tried to redeploy.
|
CSCvb74873
|
If you enabled SMB File Inspection in a file policy and deployed to a device managed by theFirepower Management
Center, Firepower generated Primary detection engine exited unexpectedly warning messages, and Firepower could experience issues.
|
CSCvb75591
|
If you deployed a DNS rule with a blacklist action containing a Security Intelligence DNS feed, Firepower did not send the Security Intelligence events to the external syslog if one was configured.
|
CSCvb78786
|
Firepower ignored security zone constraints on network discovery rules if the network discovery policy contained rules constrained by zones that included interfaces from multiple devices. This condition was present if the rules used single zones with interfaces from multiple devices (for example, Zone 1 included interfaces from Device 1 and Device 2) or multiple rules used different zones (for example if Rule 1 used Zone 1, which included interfaces from Device 1, and Rule 2 used Zone 2, which included interfaces from Device 2).
|
CSCvb79079
|
Resolved an issue where, if you added a syslog alert to an access control rule and deployed on an ASA FirePOWER module managed by ASDM, the device incorrectly generated excessive logging from prefilter policies.
|
CSCvb80872
|
Resolved an issue where, in some cases, updating a system to Version 6.1.0 and deploying to a registered device generated a Deployment failed in policy and object collection. If problem persists after retrying, contact TAC error message.
|
CSCvb88561
|
Resolved an issue where, if Firepower processed HTTP traffic containing XFF headers, Firepower experienced issues and generated erroneous detection engine health warnings.
|
CSCvb91730
|
Attempting to change copper SFP interface type (inline/switched/routed) results in error.
|
CSCvb91613
|
Snort cores after reload when processing XFF addresses.
|
CSCvb94411
|
In some cases, if you deployed an SSL policy containing an SSL rule with the action set to Do Not Decrypt placed above an SSL rule with the action set to Decrypt - Resign, Firepower incorrectly identified the sessions as undecryptable and matched against the wrong rule with an undecryptable action instead of the correct rule.
|
CSCvb97742
|
7000
and 8000 Series devices with low memory could experience a traffic outage and not recover.
|
CSCvc05323
|
Resolved an issue where snort restarts caused Firepower to generate extraneous NGFW Rule Engine Failed to write connection event log messages. |
CSCvc08057
|
Resolved an issue where Firepower Threat Defense devices experienced Snort cores while performing QoS rate limiting on destination interface objects.
|
CSCvc08912
|
No input validation on Firepower Threat Defense Platform Setting syslog Logging Filter.
|
CSCvc09761
|
Cannot delete multiple rules at a time from ASA migrated Prefilter Policies.
|
CSCvc10655
|
Resolved an issue where deploying policies to a Firepower Threat Defense device failed after updating to a new Firepower version.
|
CSCvc14561
|
Resolved an issue where the Firepower Management
Center web interface was not available after enabling compliance mode.
|
CSCvc26880
|
Resolved an issue where, if a Firepower 8350 device or AMP8350 device produced an unusually large stream of messages on the serial port console or, if you enabled it, the Lights-out Management (LOM) console, the device became unresponsive.
|
CSCvc30591
|
eStreamer should use correct datastore for user identity mapping.
|
CSCvc31852
|
Resolved an issue where the Firepower Management
Center Tasks tab displayed an incorrect amount of time taken for policy deployment.
|
CSCvc36047
|
Having 0 at the object service PING service icmp echo 0 causes migration to fail.
|
CSCvc37923
|
Resolved an issue where Firepower did not recover from a disk write error caused by disk full even after the disk full issue was resolved, causing excessive logging.
|
CSCvc37927
|
Import fails with duplicate object name when the object names differs by case only.
|
CSCvc44398
|
URL not extracted from reassembled requests.
|
CSCvc49641
|
Snort process segfaults processing traffic in firewall.
|
CSCvc49789
|
OptimizeTables.pl always fails on 6.1.0.
|
CSCvc53628
|
Available Ports tab hangs when editing prefilter rule ports.
|
CSCvc54134
|
Resolved an issue where, when a Firepower Threat Defense high availability pair simultaneously rebooted, the pair continuously rebooted until the failover cable was removed.
|
CSCvc55170
|
Firepower Management
Center login stops working if resume sync is selected after upgrade.
|
CSCvc58398
|
Firepower Management
Center warnings needed during high availability configuration that configuration on the standby Firepower Management
Center will be wiped.
|
CSCvd78303
|
Resolved an issue where the Firepower Threat Defense device running Version 6.1.0.1 or Version 6.1.0.2 stopped passing traffic after 213 days of uptime and experienced a range of issues from limited connectivity to a traffic outage.
|