

Rewterz Threat Advisory – Virtual Box zero-day vulnerability exposed
November 8, 2018
Rewterz Threat Advisory – CVE-2018-15961 – Adobe ColdFusion Patched Vulnerability Exploited by Hackers
November 12, 2018
Rewterz Threat Advisory – Virtual Box zero-day vulnerability exposed
November 8, 2018
Rewterz Threat Advisory – CVE-2018-15961 – Adobe ColdFusion Patched Vulnerability Exploited by Hackers
November 12, 2018Cisco’s TCP intrusion prevention system can be bypassed due to a vulnerability in firepower detection engine.
IMPACT: MEDIUM
PUBLISH DATE: 09-11-2018
OVERVIEW
Due to incorrect TCP retransmission handling, an attacker can bypass some rules of Cisco Fire Power’s Intrusion Prevention System. No patches are available for this vulnerability.
Analysis
The detection engine of Cisco Firepower System Software contains a vulnerability which could allow an unauthenticated, remote attacker to bypass some of the configured rules of its Intrusion Prevention System (IPS). The system is designed to inspect certain types of TCP traffic. Once affected, the traffic inspection fails to detect certain malicious traffic and may let an attacker enter the network. The vulnerability exists due to incorrect TCP retransmission handling.
In order to exploit this vulnerability, an attacker can send a crafted TCP connection request through an affected device. If successful, the exploit could allow the attacker to bypass configured IPS rules and allow uninspected traffic onto the network.
Affected Products
This vulnerability affects Cisco Firepower System Software releases before the first fixed release where the device is configured with an IPS rule for TCP traffic inspection.
RESOLVE
There are no workarounds available for fixing this vulnerability yet.
If you think you are a victim of a cyber-security attack. Immediately send an email to soc@rewterz.com for a rapid response.