Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Cisco’s TCP intrusion prevention system can be bypassed due to a vulnerability in firepower detection engine.
IMPACT: MEDIUM
PUBLISH DATE: 09-11-2018
OVERVIEW
Due to incorrect TCP retransmission handling, an attacker can bypass some rules of Cisco Fire Power’s Intrusion Prevention System. No patches are available for this vulnerability.
Analysis
The detection engine of Cisco Firepower System Software contains a vulnerability which could allow an unauthenticated, remote attacker to bypass some of the configured rules of its Intrusion Prevention System (IPS). The system is designed to inspect certain types of TCP traffic. Once affected, the traffic inspection fails to detect certain malicious traffic and may let an attacker enter the network. The vulnerability exists due to incorrect TCP retransmission handling.
In order to exploit this vulnerability, an attacker can send a crafted TCP connection request through an affected device. If successful, the exploit could allow the attacker to bypass configured IPS rules and allow uninspected traffic onto the network.
Affected Products
This vulnerability affects Cisco Firepower System Software releases before the first fixed release where the device is configured with an IPS rule for TCP traffic inspection.
RESOLVE
There are no workarounds available for fixing this vulnerability yet.
If you think you are a victim of a cyber-security attack. Immediately send an email to soc@rewterz.com for a rapid response.