Rewterz Threat Advisory – CVE-2018-15443 – Cisco Firepower Detection Engine TCP Intrusion Prevention System Rule Bypass Vulnerability

Cisco’s TCP intrusion prevention system can be bypassed due to a vulnerability in firepower detection engine.

IMPACT:  MEDIUM

PUBLISH DATE:  09-11-2018

OVERVIEW

Due to incorrect TCP retransmission handling, an attacker can bypass some rules of Cisco Fire Power’s Intrusion Prevention System. No patches are available for this vulnerability.

Analysis

The detection engine of Cisco Firepower System Software contains a vulnerability which could allow an unauthenticated, remote attacker to bypass some of the configured rules of its Intrusion Prevention System (IPS). The system is designed to inspect certain types of TCP traffic. Once affected, the traffic inspection fails to detect certain malicious traffic and may let an attacker enter the network. The vulnerability exists due to incorrect TCP retransmission handling.

In order to exploit this vulnerability, an attacker can send a crafted TCP connection request through an affected device. If successful, the exploit could allow the attacker to bypass configured IPS rules and allow uninspected traffic onto the network.

Affected Products

This vulnerability affects Cisco Firepower System Software releases before the first fixed release where the device is configured with an IPS rule for TCP traffic inspection.

RESOLVE

There are no workarounds available for fixing this vulnerability yet.

If you think you are a victim of a cyber-security attack. Immediately send an email to soc@rewterz.com for a rapid response.