Cisco’s TCP intrusion prevention system can be bypassed due to a vulnerability in firepower detection engine.
PUBLISH DATE: 09-11-2018
Due to incorrect TCP retransmission handling, an attacker can bypass some rules of Cisco Fire Power’s Intrusion Prevention System. No patches are available for this vulnerability.
The detection engine of Cisco Firepower System Software contains a vulnerability which could allow an unauthenticated, remote attacker to bypass some of the configured rules of its Intrusion Prevention System (IPS). The system is designed to inspect certain types of TCP traffic. Once affected, the traffic inspection fails to detect certain malicious traffic and may let an attacker enter the network. The vulnerability exists due to incorrect TCP retransmission handling.
In order to exploit this vulnerability, an attacker can send a crafted TCP connection request through an affected device. If successful, the exploit could allow the attacker to bypass configured IPS rules and allow uninspected traffic onto the network.
This vulnerability affects Cisco Firepower System Software releases before the first fixed release where the device is configured with an IPS rule for TCP traffic inspection.
There are no workarounds available for fixing this vulnerability yet.
If you think you are a victim of a cyber-security attack. Immediately send an email to firstname.lastname@example.org for a rapid response.