CSCuw70987, CSCux50957, CSCux86317
|
Resolved multiple vulnerabilities within the third party Open SSH, as described in CVE-2015-5600, CVE-2015-6565, CVE-2016-0777,
and CVE-2016-0778.
|
CSCuw88390, CSCuw88396, CSCuw89094
|
Addressed a cross-site scripting (XSS) vulnerability, as described in CVE-2015-6363 and CVE-2016-1294.
|
CSCux41304, CSCuz52366, CSCvb24543, CSCvb48536
|
Addressed multiple vulnerabilities that generated denial of service in OpenSSL, as described in CVE-2015-3194, CVE-2015-3195,
CVE-2015-3196, CVE-2016-2105, CVE-2016-2106 CVE-2016-2107, CVE-2016-2108, CVE-2016-2109, CVE-2016-2176, CVE-2016-2177, CVE-2016-2178,
CVE-2016-2179, CVE-2016-2180, CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305,
CVE-2016-6306 CVE-2016-6307 CVE-2016-6308 CVE-2016-6309 CVE-2016-7052 CVE-2015-3194, CVE-2015-3195 and CVE-2015-3196.
|
CSCux42288
|
Addressed a vulnerability issue in the third party Java, as described in CVE-2015-6420.
|
CSCux90163
|
Resolved a vulnerability where a user without Admin without privileges could delete other users' scheduled tasks.
|
CSCuy32284
|
Addressed a vulnerability in the third party GNU C Library, as described in CVE-2015-7547.
|
CSCuz52939, CSCvb24561, CSCvb24562
|
Addressed multiple vulnerabilities in the third party product Libxml2, as described in CVE-2016-2073, CVE-2016-444, and CVE-2016-4448.
|
CSCuz92632
|
Addressed multiple vulnerabilities in the third party product NTP, as described in CVE-2016-4953, CVE-2016-4954, CVE-2016-4955,
CVE-2016-4956, and CVE-2016-4957.
|
CSCvb24566, CSCvb24564
CSCuz52935
|
Address multiple vulnerabilities in the Libarchive, as described in CVE-2016-1541, CVE-2016-5844, and CVE-2016-6250.
|
CSCuu96447
|
In some cases, if you deleted the permanent license from the Licenses page , the Device Management page did not display Unlicensed for devices the permanent license was deleted from when it should have, and policy deploy would fail.
|
CSCux64898
|
In some cases, if you deployed an access control policy with the default action set to Block and executed the configure network management-interface disable-event-channel CLI command, Firepower continued to generate intrusion and connection events when it should not have.
|
CSCux78211
|
Resolved an issue where, if an ASA FirePOWER module in high availability experienced a partial failure, the device did not
failover when it should have.
|
CSCux91934
|
Resolved an issue where, if you deployed an SSL policy configured with a rule associated with an expired SSL certificate,
Firepower used an incorrect SSL rule.
|
CSCuy28088
|
Cannot apply FP8130-CTRL-LIC to AMP8050.
|
CSCuy49371
|
If you clicked Create Email Alert on the Alerts page and enabled Retrospective Events configuration on the Advanced Malware Protection Alerts tab, then saved and applied, the email alerts generated by Firepower when the alert
was triggered were truncated. Emails should not have been truncated.
|
CSCuy51566
|
If you updated a Firepower Management Center from Version 5.4.x to Version 6.0.0 or later and created a new sub domain and deployed a network discovery policy, you could
not delete any objects or object groups referenced by the network discovery policy in the global domain.
|
CSCuy57756
|
In some cases, if you broke a Firepower Threat Defense high availability pair, one of the devices in the pair stayed in standalone mode and Firepower could not recreate the high
availability pair.
|
CSCuy67210
|
Not able to disable notifications on the Firesight manager Web interface.
|
CSCuy68648
|
Resolved an issue where, if you added a security zone on a Firepower Management Center running Version 5.4.0 or later and updated Firepower to Version 6.0.0 or later and deleted the security zone, Firepower generated
an Object deletion restricted. Remove object from the following: Access control policies error even if the security zone was not referenced within a rule.
|
CSCuy83201
|
Fatal errors on applying policy from 6.0.0.1 with different vulnerability database.
|
CSCuz17315
|
Resolved an issue where Firepower generated erroneous Error found during SSL flow after server certificate messages for evicted SSL flows.
|
CSCuz17723
|
Firepower 9300 devices' high availability status is displayed incorrectly/inconsistent in the Firepower Management Center.
|
CSCuz24872
|
Original Client IP does not populate for dropped events when inline normalization enabled.
|
CSCuz46366
|
Firepower incorrectly allowed you configure sandbox file sizes from 0 MB to 100 MB on the Files and Malware Settings section
on the Advanced tab of the access control editor. Firepower only supports capturing files as large as 10 MB. If you configured
the sandbox environment to a file size larger than 10 MB, Firepower did not capture the file.
|
CSCuz49023
|
Resolved an issue where despite configuration of impact flag alerting for an eStreamer client, Firepower did not stream impact
flag data.
|
CSCuz54417
|
If you deployed an SSL policy containing application rule conditions for SMTPS, POP3S, and IMAPS traffic, Firepower might have incorrectly displayed Unknown as the application protocol in the Connection Events page .
|
CSCuz78239
|
DLL-Load vulnerability in Snort on Windows platforms.
|
CSCuz92255
|
Resolved an issue where, if you tested the default storage type on the Remote Stage Device section of the Configuration page
, Firepower incorrectly generated a Please enter valid host. Please enter a valid Directory path. error message.
|
CSCuz92983
|
Policy deployment fails with mode 10 Gbit Full-Duplex for lag interface.
|
CSCuz94444
|
Resolved an issue where the associated client incorrectly rejected resigned certificates for Apple related products and you
could not log into iTunes.
|
CSCuz95008
|
Resolved an issue where, if you requested pre 6.0.0 metadata from a Firepower Management Center with eStreamer running Version 6.0.0. or later, Firepower incorrectly sent the userID field to the eStreamer client instead of the configured LDAP username.
|
CSCuz99677
|
Resolved an issue where, if you created a new user with an administrator role and deployed configuration, Firepower incorrectly
displayed the default admin user as the user deploying the configuration instead of the newly created user.
|
CSCva00234
|
Resolved an issue where policy comparison did not include the high availability health modules when it should have.
|
CSCva01674
|
sfestreamer crashes when we have 4 management interfaces on Firepower Management Center.
|
CSCva12481
|
Disk manager marks conn-unified as deleted.
|
CSCva28854
|
Under rare conditions, when 7000
and 8000 Series devices where firstboot policy apply failed, file handles are depleted on the device which caused health/hardware alarms
and a variety of malfunctions.
|
CSCva29636
|
Resolved an issue where, if you configure network management for a Firepower Threat Defense virtual device, the console incorrectly provided an HTTPS address to complete the installation when it should not have.
|
CSCva37443
|
If your ASA configuration file contained an invalid ICMP service object, the ASA-to-Firepower Threat Defense migration tool failed, but did not log adequate information to troubleshooting logs. Migration no longer fails under this
condition. Instead, the tool excludes the invalid ICMP objects from the conversion, converts the related ASA access rules
to disabled Firepower Threat Defense rules, and adds a comment to the rules describing the unsupported case.
|
CSCva38608
|
Resolved an issue where SHA1 signed certificate with a modern browser and Firepower generated untrusted certificate errors
for modern browser.
|
CSCva41164
|
Version 6.2.0 does not support access control policy names including the $ character.
|
CSCva47456
|
Resolved an issue where, if Firepower requested a URL lookup and the cloud did not immediately return a URL category, the
cached request incorrectly remained marked as Pending instead of updating the URL type to Uncategorzied.
|
CSCva49869
|
Report generation did not give a failed message, continues in queue for week.
|
CSCva51022
|
If you deployed a pair of network object groups to a Firepower Threat Defense high availability pair and the network object group IP addresses on either the active and standby device overlapped with
the IP addresses on the other device within the pair, deployment failed and Firepower generated a Deployment failed due to
configuration error message in the Message Center.
|
CSCva51662
|
Resolved an issue where, if you clicked Launch Readiness Check while another readiness check is in the queue and closed the dialog window, Firepower incorrectly started a new readiness
check task .
|
CSCva57174
|
On a Firepower Threat Defense Virtual with RIP and redistribution configured, even if you disabled RIP and redeployed, the device continued to use RIP.
|
CSCva58269
|
Resolved an issue where, if you created alerts associated with a domain and then deleted the domain, Firepower did not remove
the alerts from the database when it should have.
|
CSCva58393
|
User is able to apply smart licenses on AWS HB device.
|
CSCva58411
|
Resolved an issue where, if you added smart licenses to a Firepower Threat Defense high availability pair, the smart licensing widget on the dashboard page did not load.
|
CSCva59135
|
The ASA-to-Firepower Threat Defense migration tool can convert only one ASA configuration file at a time. If you started a conversion while a conversion task
was in progress, Firepower displayed an Error 500 Internal server error message. Firepower now displays a warning message that a migration is already in progress.
|
CSCva63604
|
Resolved an issue where, if a security module on a Firepower Threat Defense cluster with an access control policy containing more than 10,000 rules reloaded, the security module failed to re-join the
cluster and generated a All data interfaces have been shutdown due to clustering being disabled. To recover either enable clustering or remove cluster
group configuration warning.
|
CSCva67943
|
Resolved an issue where, if you enabled common criteria (CC) mode on an appliance for security certifications compliance and
the syslog server certificate did not contain serverAuth, Firepower incorrectly passed connections to the syslog server when
they should have failed.
|
CSCva72899
|
Access control policy report fails if category has span across 50 rules.
|
CSCva81548
|
Improved configuration deployment performance.
|
CSCva82945
|
The Interfaces tab of the device management page for a Firepower Threat Defense device now displays the current status for interfaces on the device.
|
CSCva89328
|
Resolved an issue where, if you deployed an intrusion rule containing an AppID web application condition and a managed device
experienced a high volume of traffic containing an excessive amount of similar connection types that did not apply to the
AppID application, the application detection process took more time than it normally should and caused latency for other traffic
matches.
|
CSCva89342
|
If you created an ASA Firepower module high available pair configured for multi-context mode and deployed one or more security
zone from the managing Firepower Management Center, then the standby ASA Firepower module within the pair restarted, the standby
ASA Firepower module incorrectly removed all security zones and interfaces.
|
CSCva93408, CSCva93158
|
Improved the RPC decoder.
|
CSCva99998
|
Resolved an issue where Firepower did not restrict read-only users from editing the blacklist page when it should have.
|
CSCvb02417
|
Adaptive profiling performance scales badly in some cases.
|
CSCvb02846
|
Resolved a rare issue where, if you switched Firepower Management Center high availability peers twice and viewed the Smart Licenses page , the table of devices and any edit windows failed to load.
|
CSCvb05694
|
Resolved an issue where, if you deployed an SSL policy and traffic with an HTTP tunnel matched the SSL policy, Firepower dropped
some traffic and experienced high CPU use and overall latency.
|
CSCvb08840
|
Resolved an issue where, if you enabled automated intrusion rule updates for an ASA Firepower module managed by ASDM, and
the device simultaneously deployed automated deployments, the device experienced issues.
|
CSCvb11574
|
Resolved an issue where, if you deployed an access control policy containing a custom application detector and deleted the
application detector, Firepower did not generate a warning that the application detector must be removed from the access control
policy prior to deletion.
|
CSCvb11642
|
Resolved an issue where, if you created a network discovery policy configured to detect hosts and a correlation policy containing
a rule set to trigger if discovery event occurs and the OS information for a host has changed, then added a condition for
if OS name is unknown and added a remediation Nmap scan, discovery events matching the rules did not generated corresponding
Nmap scans.
|
CSCvb11931
|
Resolved an issue where, if Firepower experienced an issue processing the first session of SMTP traffic between a client and
an SMTP server, Firepower did not correctly identify the subsequent SMTP sessions as SMTP for the client-server pair and displayed
Unknown in the Application Protocol column of the Connection Events page .
|
CSCvb12453
|
Resolved an issue where, if you enabled common criteria (CC) mode on an appliance for security certifications compliance and
the syslog server certificate did not contain host name matching the name of the server, connections to the syslog server
incorrectly passed when they should have failed.
|
CSCvb12791
|
Resolved an issue where, if you enabled Common Criteria (CC) mode on an appliance for security certifications compliance and
the syslog server certificate and/or intermediate certificate(s) have been revoked, Firepower incorrectly established a TLS
connection with the syslog server without checking the revocation status.
|
CSCvb14402
|
Traffic by Initiator Report for User Renders No Output.
|
CSCvb19366
|
Cisco Firepower Management Center Information Disclosure Vulnerability.
|
CSCvb19716
|
Resolved an issue where Firepower Management Center high availability synchronization failed if the total size of the database files and logs totaled more than 4GB.
|
CSCvb20859
|
Intermittently, if the ASA-to-Firepower Threat Defense migration tool could not migrate an ASA configuration because the access control list was not applied via a valid access-group
command, Firepower did not complete internal operations related to that migration, and you could not start another migration.
|
CSCvb24378
|
You can now enable or disable default inspection with the command line interface on a Firepower Threat Defense device using configure inspection <inspection_name> enable|disable.
|
CSCvb24768
|
Resolved an issue where, in some cases, if you updated a system containing at least one security zone to Version 6.1 or later,
the Interfaces page might incorrectly displayed the security zone state as Unknown .
|
CSCvb24807
|
In rare cases, after you updated the Firepower Management Center to Version 6.10, the dynamic analysis page would not load.
|
CSCvb25963
|
Resolved an issue where, if you formed a Firepower 4100 series series or Firepower 9300 high availability pair with devices containing named interfaces and assigned a portchannel from the FXOS chassis manager,
then edited the Interfaces tab of the high availability pair listed on the Device Management page and saved, Firepower did not include the interfaces created for the high availability pair when it should and, in some cases,
deployment failed.
|
CSCvb26266
|
Resolved an issue where, if you enabled captive portal on a system and updated to Version 6.1.0, captive portal did not work.
|
CSCvb28158
|
Workflow set with User Preferences not honored by Search Constraints.
|
CSCvb28202
|
False warnings in database Integrity Check for PlatformSettings object.
|
CSCvb32484
|
Upgrade to 6.1 fails at 600_schema/000_install_csm.sh.
|
CSCvb32873
|
Cannot create new Application Filter Objects 6.1 on ASA managed by ASDM.
|
CSCvb35499
|
Resolved an issue where, in some cases, if you updated a system from Version 6.1.0 to Version 6.1.0.x, the update failed.
|
CSCvb35861
|
Resolved an issue where, if you created a high availability pair and synchronization requests overload the Tasks tab in the
Message Center, Firepower experienced disk space issues and intermittent login issues.
|
CSCvb36645
|
Resolved an issue where, if incoming HTTP, TCP, or SSH traffic did not contain an SGT value in the header, traffic matched
against the default access control policy instead of any other configured policy.
|
CSCvb36847
|
Event QoS in legacy mode does not have an entry for interface stats.
|
CSCvb39325
|
Resolved an issue where incoming HTTP and HTTPS traffic containing XFF fields caused system issues.
|
CSCvb39435
|
If you updated Firepower from a version earlier than Version 6.1.0 to Version 6.1.0 and immediately exported the access control
policy, then imported the policy, importing the access control policy failed.
|
CSCvb40344
|
If you deployed a file policy to a device with an excessive amount of endpoints configured, Firepower experienced high CPU
and memory use. As a workaround, you could redeploy configuration.
|
CSCvb41047
|
Resolved an issue where Firepower generated an incorrect Health monitoring running behind schedule health warning if the Firepower Management Center did not receive any health events from registered devices.
|
CSCvb42559
|
Firepower Management Center Smart Licensing bypasses Proxy Configuration when in evaluation mode.
|
CSCvb43868
|
Upgrade failing for v6.0.1 at 600_schema/000_install_csm.sh.
|
CSCvb44812
|
Resolved an issue where Firepower 4100 series series devices generated excessive logging and experienced storage space issues.
|
CSCvb44268
|
Resolved an issue where the Appliance Status widget did not load if you had 400 or more devices attached to a Firepower Management Center.
|
CSCvb46146
|
If updating Firepower failed and you attempted to update to a different version from the one that failed without resolving
the original failure, the new install also failed and could cause Firepower to become unrecoverable.
|
CSCvb46555
|
Resolved an issue where, if you enabled Safe Search in an access control policy and deployed, Firepower incorrectly generated Primary Detection Engine Exiting health alerts.
|
CSCvb47847
|
Resolved an issue where, if you updated a system from Version 6.0.1.1 or later to Version 6.1.0, Firepower experienced a variety
of issues such as update failure or Firepower Management Center login failure.
|
CSCvb51077
|
Resolved an issue where, if you added a remediation as a response to a rule in a correlation policy on a Firepower Management Center and created a high availability pair, then switch high availability peers, the new active Firepower Management Center did not correctly synchronize the correlation policy and the remediation experienced issues.
|
CSCvb52057
|
Resolved an issue where, if you deployed an access control policy containing rules with Safe Search enabled, some websites experienced latency when loading.
|
CSCvb57521
|
Firepower Management Center/FTD - Multiple default routes with same metric or gateway exists.
|
CSCvb57747
|
Deploy during intrusion rule update install may cause all subsequent policy applies to fail.
|
CSCvb60088
|
FTD policy deployment fails with Syslog Event class All.
|
CSCvb61055
|
Security Intelligence synchronization failure results in disk becoming full.
|
CSCvb61156
|
Resolved an issue where, if a Firepower Management Center running Version 6.1.0 managed a device running a version earlier than Version 6.1.0, Firepower did not generate any new discovery
events and removed the network map several days after the Firepower Management Center updated to Version 6.1.0.
|
CSCvb61480
|
In some cases, if Firepower processed SIP packets, traffic containing voice or video content might have appeared distorted
or experienced latency.
|
CSCvb61836
|
Resolved an issue where Firepower logged extraneous policy information during deployment and, in some cases, deploying large
policies failed.
|
CSCvb65648
|
Resolved an issue where, if you deployed an access control policy containing an identity policy that referenced a realm or
access control rules containing groups or users from the realm and you deleted the realm, Firepower incorrectly generated
a System defined Objects cannot be Altered. Please use a different Object error and you could not edit the access control policy.
|
CSCvb66591
|
If you configured a realm for an Active Directory (AD) server to download users and groups, then created a Firepower Management Center high availability pair and the downloads contained large amounts of users and groups, Firepower Management Center high availability registration failed.
|
CSCvb67568
|
Resolved a rare issue where, if you created a realm and deployed an access control policy containing rules, then clicked Download users and groups and configured a User Agent connection, the user to group mapping became incorrect and access control rules using groups
did not match when it should.
|
CSCvb68226
|
SFR upgrade to 6.1 causes constant failover between ASA FirePOWER module high availability pair.
|
CSCvb69742
|
6.0.0 pre install 5.4.0.999 nfp kernel modules fail to unload followed by outage.
|
CSCvb69906
|
Intermittently, if you created a realm and deployed an access control policy containing rules, then downloaded users and groups
(including scheduled downloads), the user-to-group mapping could become incorrect, and access control rules using groups might
not have matched when they should have.
|
CSCvb70125
|
Resolved an issue where policy deploy failed if you configured captive portal on a Firepower Management Center then updated the Firepower Management Center and its managed devices, then tried to redeploy.
|
CSCvb74873
|
If you enabled SMB File Inspection in a file policy and deployed to a device managed by theFirepower Management Center, Firepower generated Primary detection engine exited unexpectedly warning messages, and Firepower could experience issues.
|
CSCvb75591
|
If you deployed a DNS rule with a blacklist action containing a Security Intelligence DNS feed, Firepower did not send the
Security Intelligence events to the external syslog if one was configured.
|
CSCvb78786
|
Firepower ignored security zone constraints on network discovery rules if the network discovery policy contained rules constrained
by zones that included interfaces from multiple devices. This condition was present if the rules used single zones with interfaces
from multiple devices (for example, Zone 1 included interfaces from Device 1 and Device 2) or multiple rules used different
zones (for example if Rule 1 used Zone 1, which included interfaces from Device 1, and Rule 2 used Zone 2, which included
interfaces from Device 2).
|
CSCvb79079
|
Resolved an issue where, if you added a syslog alert to an access control rule and deployed on an ASA FirePOWER module managed
by ASDM, the device incorrectly generated excessive logging from prefilter policies.
|
CSCvb80872
|
Resolved an issue where, in some cases, updating a system to Version 6.1.0 and deploying to a registered device generated
a Deployment failed in policy and object collection. If problem persists after retrying, contact TAC error message.
|
CSCvb88561
|
Resolved an issue where, if Firepower processed HTTP traffic containing XFF headers, Firepower experienced issues and generated
erroneous detection engine health warnings.
|
CSCvb91730
|
Attempting to change copper SFP interface type (inline/switched/routed) results in error.
|
CSCvb91613
|
Snort cores after reload when processing XFF addresses.
|
CSCvb94411
|
In some cases, if you deployed an SSL policy containing an SSL rule with the action set to Do Not Decrypt placed above an SSL rule with the action set to Decrypt - Resign, Firepower incorrectly identified the sessions as undecryptable and matched against the wrong rule with an undecryptable
action instead of the correct rule.
|
CSCvb97742
|
7000
and 8000 Series devices with low memory could experience a traffic outage and not recover.
|
CSCvc05323
|
Resolved an issue where snort restarts caused Firepower to generate extraneous NGFW Rule Engine Failed to write connection event log messages. |
CSCvc08057
|
Resolved an issue where FTD devices experienced Snort cores while performing QoS rate limiting on destination interface objects.
|
CSCvc08912
|
No input validation on FTD Platform Setting syslog Logging Filter.
|
CSCvc09761
|
Cannot delete multiple rules at a time from ASA migrated Prefilter Policies.
|
CSCvc10655
|
Resolved an issue where deploying policies to a FTD device failed after updating to a new Firepower version.
|
CSCvc14561
|
Resolved an issue where the Firepower Management Center web interface was not available after enabling compliance mode.
|
CSCvc26880
|
Resolved an issue where, if a Firepower 8350 device or AMP8350 device produced an unusually large stream of messages on the
serial port console or, if you enabled it, the Lights-out Management (LOM) console, the device became unresponsive.
|
CSCvc30591
|
eStreamer should use correct datastore for user identity mapping.
|
CSCvc31852
|
Resolved an issue where the Firepower Management Center Tasks tab displayed an incorrect amount of time taken for policy deployment.
|
CSCvc36047
|
Having 0 at the object service PING service icmp echo 0 causes migration to fail.
|
CSCvc37923
|
Resolved an issue where Firepower did not recover from a disk write error caused by disk full even after the disk full issue
was resolved, causing excessive logging.
|
CSCvc37927
|
Import fails with duplicate object name when the object names differs by case only.
|
CSCvc44398
|
URL not extracted from reassembled requests.
|
CSCvc49641
|
Snort process segfaults processing traffic in firewall.
|
CSCvc49789
|
OptimizeTables.pl always fails on 6.1.0.
|
CSCvc53628
|
Available Ports tab hangs when editing prefilter rule ports.
|
CSCvc54134
|
Resolved an issue where, when a FTD high availability pair simultaneously rebooted, the pair continuously rebooted until the failover cable was removed.
|
CSCvc55170
|
Firepower Management Center login stops working if resume sync is selected after upgrade.
|
CSCvc58398
|
Firepower Management Center warnings needed during high availability configuration that configuration on the standby Firepower Management Center will be wiped.
|
CSCvd78303
|
Resolved an issue where the FTD device running Version 6.1.0.1 or Version 6.1.0.2 stopped passing traffic after 213 days of uptime and experienced a range
of issues from limited connectivity to a traffic outage.
|