5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.974 High
EPSS
Percentile
99.9%
The remote Cisco Firepower Threat Defense (FTD) Software is missing a vendor-supplied security patch. It is, therefore, affected by a vulnerability in the web interface due to improper validation of the HTTP URL. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic.
Note that Nessus has not tested for this issue but has instead relied only on the applicationâs self-reported version number.
#TRUSTED 1866dd3121350eeed6c70e244c712e1df8187b478a37dc85dfb11d87b3e4f8a0e433a07d57f79e21e375c39f42b43b0af2459571479893ae2c1c993eb571ca7c51c57de53ae29526112eeacf78b1767af99eee4c1e333daa2ad736fe9f4582bc6936db4faadcde604048ce59b72ad25a6eab4ae3d0ed76db948227dae554848947b949b5153b5e0174edeead185da25b649d77bca037959a896be0f3419dbd702db3b01112c0b31740a780965a201ea6c475a2365f0a84cd536eb57f385dd2ecc76705fe8707e7b53197300c8af90d88556c7c0554e25353c0d8b747cc342e3cf3cddc9c1421947822c6ec243e2daf692a77a77bc87465e9bc86816778dc298c9335763674264439d6536fb9f4276980f61cd5f3da0c2389fcdee0753048d21449e1939ec01d5e08258ed6379828f460c7725a415d729bd4e65b3eec80efb743d711371107f42a34f752797dd607110a9d9779aeb91dd863780d2c07c53f1a45938b10746008730701052316fe980977eda4f88921080416bc298d0d66c27878089ea65270e9f03dfb997bb662be8c59bd4a207898db793ac9ad27e235c3f92efa5dc21fabfc3dbd191aed22a3ea7d11afad9e0f6e383b15016ec5977e600e28f1687572313dd826a64b148f99ec934cec15951fb5e490e950c4382dd5ec0c92778403820c42a1d402cb73727954d011ec1f4b813d03923fe2880b782da7fc42
#TRUST-RSA-SHA256 6c5c8cc697c5843fb5d1cdd8b871c53a42edfbf89fcb49fed8364ddaf287c2a484090fef3426ee03fc12bc425c7336a0ae3e75ab9d41c3e9bf518fd21251d451f74be905637b7fe3a2cf890ec2dc9c59565e34774d7510fb9c9c747db1bc28706681bddeeeeb966e30e5b204316f367d33a21fe4994df464c4f1695e58c7b0f54e0aaa51c05154ecbd821c8d338d8f3a62d3fbbc7447c82de5a24333dee22c0a9ae6f2a5ad16cc400ede6366002073acd6810adbf9ac249fb9ddbfa89316c138d2360293fa308c3416c02beefdc5f451df9d275895cafaf00f39979f51b679aa30117a1f23b9bb99dd8fc5763ea5b674b4c51789152072b92b9cde4913f6ae50c0f4affcdce10088214f0e5ef2227538fb16ea9bde2e0a4df625bcb2be591619d272916c47bd6f8d1fa603b5ec638b3b3e95477e00acfaaf60faf900ac0f6784763f5237dc53fb555e50f06407e3b15132ca43087cc09f1cf81d451bd80ddb1f4e6400be13ea90755d42b6fe7033e07b756bbd54e1b4aa505da9447409f6fd22aba435e9df22e8eb080293e0dba101f58f929b8b86884f49169d1defbf2c00e1522d235f92937ecab727c743cb9311e55737f22ea1797a2d3f84e6ba4b7325c6f94a35cb790853e6ae758e0f12e94e70f4a50a68a880ba09edb7ab68b1fe8a54708758c63e24e81044b0e05b6b7d26646d152fc4d175ab732efb71f7791dd8e4
#
# (C) Tenable Network Security, Inc.
#
include('compat.inc');
if (description)
{
script_id(124172);
script_version("1.15");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/04/25");
script_cve_id("CVE-2018-0296");
script_bugtraq_id(104612);
script_xref(name:"CISCO-BUG-ID", value:"CSCvi16029");
script_xref(name:"CISCO-SA", value:"cisco-sa-20180606-asaftd");
script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/05/03");
script_xref(name:"CEA-ID", value:"CEA-2019-0741");
script_xref(name:"CEA-ID", value:"CEA-2019-0240");
script_name(english:"Cisco FTD Web Services DoS (cisco-sa-20180606-asaftd)");
script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
script_set_attribute(attribute:"description", value:
"The remote Cisco Firepower Threat Defense (FTD) Software is missing a vendor-supplied security patch. It is,
therefore, affected by a vulnerability in the web interface due to improper validation of the HTTP URL. An
unauthenticated, remote attacker can exploit this, via a specially crafted HTTP request, to cause a DoS condition or
unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c235f451");
script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvi16029");
script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco security
advisory cisco-sa-20180606-asaftd.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0296");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/06");
script_set_attribute(attribute:"patch_publication_date", value:"2018/06/06");
script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/19");
script_set_attribute(attribute:"potential_vulnerability", value:"true");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:firepower");
script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:firepower_threat_defense");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CISCO");
script_copyright(english:"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl", "cisco_asa_firepower_version.nasl", "cisco_enumerate_firepower.nbin");
script_require_keys("installed_sw/Cisco Firepower Threat Defense", "Settings/ParanoidReport");
exit(0);
}
include('vcf.inc');
include('audit.inc');
include('cisco_workarounds.inc');
include('ccf.inc');
if (report_paranoia < 2)
audit(AUDIT_PARANOID);
app = 'Cisco Firepower Threat Defense';
app_info = vcf::get_app_info(app:app);
product_info = make_array('model' , app_info['Model'], 'version' , app_info['version'], 'name', app);
ver = product_info['version'];
model = product_info['model'];
if (
model !~ '^1000V' && # 1000V
model !~ '^30[0-9][0-9]($|[^0-9])' && # 3000 ISA
model !~ '^55[0-9][0-9]' && # 5500
model !~ '^55[0-9][0-9]-X' && # 5500-X
model !~ '^65[0-9][0-9]($|[^0-9])' && # 6500
model !~ '^76[0-9][0-9]($|[^0-9])' && # 7600
model != 'v' && # ASAv
model !~ '^21[0-9][0-9]($|[^0-9])' && # Firepower 2100 SSA
model !~ '^41[0-9][0-9]($|[^0-9])' && # Firepower 4100 SSA
model !~ '^93[0-9][0-9]($|[^0-9])' # Firepower 9300 ASA
) audit(AUDIT_HOST_NOT, 'an affected Cisco FTD product');
if (ver =~ '^6.(0|1.0)' && (model =~ '^41[0-9][0-9]($|[^0-9])' || model =~ '^93[0-9][0-9]($|[^0-9])'))
fix = 'Cisco_FTD_SSP_Hotfix_EI-6.1.0.7-2.sh';
else if (ver =~ '^6.(0|1.0)')
fix = 'Cisco_FTD_Hotfix_EI-6.1.0.7-2.sh';
else if (ver =~ '^6.2.[12]')
fix = '6.2.2.3';
else if (ver =~ '6.2.3')
fix = '6.2.3.1 / 6.2.3-85 (Software image for FTD Virtual for the Microsoft Azure Cloud) / 6.2.3-85.0 (Software image for FTD Virtual for the AWS Cloud)';
vuln_ranges = [
{'min_ver' : '6.0', 'fix_ver' : '6.1.0.7'},
{'min_ver' : '6.2.1', 'fix_ver' : '6.2.2.3'},
{'min_ver' : '6.2.3', 'fix_ver' : '6.2.3.1'}
];
workarounds = make_list(CISCO_WORKAROUNDS['no_workaround']);
workaround_params = make_list();
reporting = make_array(
'port' , 0,
'severity' , SECURITY_WARNING,
'version' , ver,
'bug_id' , 'CSCvi16029',
'fix' , fix
);
cisco::check_and_report(
product_info:product_info,
workarounds:workarounds,
workaround_params:workaround_params,
reporting:reporting,
vuln_ranges:vuln_ranges
);
Vendor | Product | Version | CPE |
---|---|---|---|
cisco | firepower | cpe:/a:cisco:firepower | |
cisco | firepower_threat_defense | cpe:/a:cisco:firepower_threat_defense |
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.974 High
EPSS
Percentile
99.9%