Bypass Vulnerability in Cisco Firepower System Software

CVE-2018-0243

Summary

A vulnerability in Cisco Firepower System Software's detection engine may allow unauthorized remote attackers to bypass file action policies designed to block Server Message Block versions 2 and 3 (SMB2/SMB3) when malware is detected. The flaw arises from an incorrect detection mechanism regarding the total file length of SMB2 or SMB3 transfers. Attackers can exploit this vulnerability by sending specifically crafted SMB2 or SMB3 requests that escape the configured file action policies, potentially allowing the transfer of malicious files despite prior blocking configurations. Notably, this issue does not affect SMB Version 1.

References