Remote Code Execution Vulnerability in Cisco Firepower System Software

CVE-2017-12300

Summary

A vulnerability exists in the SNORT detection engine of Cisco Firepower System Software, which may allow an unauthenticated remote attacker to bypass configured file policies that block the Server Message Block Version 2 (SMB2) protocol. This issue arises from improper detection of SMB2 files when the detection is reliant on the file length. Exploiting this vulnerability enables attackers to send a specially crafted SMB2 transfer request to the affected device, potentially resulting in the bypass of established traffic filtering mechanisms designed to thwart SMB2 traffic.

References