Denial of Service Vulnerability in Cisco Firepower System Software
CVE-2016-6439

7.5HIGH

Key Information:

Vendor

Cisco
Status
Cisco Firepower System Software Before 6.0.1
Vendor
CVE Published:
27 October 2016

What is CVE-2016-6439?

A security vulnerability exists in the HTTP packet detection engine of Cisco Firepower System Software prior to version 6.0.1. This flaw can be exploited by an unauthenticated remote attacker to induce a denial of service condition. The issue stems from improper handling of crafted HTTP packet streams, potentially causing the Snort process to restart unexpectedly. When exploited, this can lead to traffic inspection being circumvented or dropped, severely impacting the system's operational integrity.

Affected Version(s)

Cisco Firepower System Software before 6.0.1 Cisco Firepower System Software before 6.0.1

References

https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM
http://www.securitytracker.com/id/1037061
vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/93787
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2016-6439 : Denial of Service Vulnerability in Cisco Firepower System Software