Lucene search

CiscoCVE-2019-1978

HistoryNov 05, 2019 - 8:15 p.m.

CVE-2019-1978

2019-11-0520:15:11

CWE-264

CWE-20

cisco

web.nvd.nist.gov

cisco

firepower

firepower services software

vulnerability

remote attacker

filtering protections

traffic streams

nvd

cve-2019-1978

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

AI Score

5.7

Confidence

High

EPSS

0.009

Percentile

83.3%

JSON

A vulnerability in the stream reassembly component of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to improper reassembly of traffic streams. An attacker could exploit this vulnerability by sending crafted streams through an affected device. An exploit could allow the attacker to bypass filtering and deliver malicious requests to protected systems that would otherwise be blocked.

Affected configurations

Nvd

Node

ciscofirepower_management_centerRange2.9.12–2.9.12.15

ciscofirepower_management_centerRange2.9.13–2.9.13.6

ciscofirepower_management_centerRange2.9.14.0–2.9.14.5

ciscofirepower_management_centerMatch2.9.15

ciscofirepower_management_centerMatch2.9.16

ciscofirepower_services_software_for_asa

ciscofirepower_threat_defense

VendorProductVersionCPE
ciscofirepower_management_center*cpe:2.3:a:cisco:firepower_management_center:*:*:*:*:*:*:*:*
ciscofirepower_management_center2.9.15cpe:2.3:a:cisco:firepower_management_center:2.9.15:*:*:*:*:*:*:*
ciscofirepower_management_center2.9.16cpe:2.3:a:cisco:firepower_management_center:2.9.16:*:*:*:*:*:*:*
ciscofirepower_services_software_for_asa*cpe:2.3:a:cisco:firepower_services_software_for_asa:*:*:*:*:*:*:*:*
ciscofirepower_threat_defense*cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	firepower_management_center	*	cpe:2.3:a:cisco:firepower_management_center::::::::
cisco	firepower_management_center	2.9.15	cpe:2.3:a:cisco:firepower_management_center:2.9.15:::::::*
cisco	firepower_management_center	2.9.16	cpe:2.3:a:cisco:firepower_management_center:2.9.16:::::::*
cisco	firepower_services_software_for_asa	*	cpe:2.3:a:cisco:firepower_services_software_for_asa::::::::
cisco	firepower_threat_defense	*	cpe:2.3:a:cisco:firepower_threat_defense::::::::

CNA Affected

[
  {
    "product": "Cisco Firepower Threat Defense Software",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "n/a",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190816-ftd-srb

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

AI Score

5.7

Confidence

High

EPSS

0.009

Percentile

83.3%

JSON

Related for CVE-2019-1978