File Action Policy Bypass in Cisco Firepower System Software

CVE-2018-0244

Summary

A vulnerability exists in Cisco Firepower System Software that enables remote attackers to circumvent the device's file action policy designed to block malicious Server Message Block (SMB) file transfers. This flaw arises from the software's improper handling of SMB protocol scenarios where large file transfers fail. When exploited, an attacker can successfully send a malicious SMB file transfer request that should be filtered out by the device's security measures. This scenario is especially concerning for environments that rely on efficient malware protection, as the flaw permits the passage of harmful content under certain conditions, compromising system integrity.

References