The vulnerability of the software detection mechanism in Cisco Firepower System Software allows attackers to circumvent the configured security policies for detecting malicious programs and files with extensions .RTF and .RAR.

🗓️ 19 Nov 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Cisco Firepower System Software malware detection can bypass security policies for Rich Text Format and RAR files due to input validation flaws.

Reporter	Title	Published	Views	Family All 9
Cisco	Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities	2 Oct 201916:00	–	cisco
Tenable Nessus	Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities (cisco-sa-20191002-firepwr-bypass)	11 Mar 202000:00	–	nessus
CVE	CVE-2019-12696	2 Oct 201919:06	–	cve
Cvelist	CVE-2019-12696 Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities	2 Oct 201919:06	–	cvelist
EUVD	EUVD-2019-4287	7 Oct 202500:30	–	euvd
NVD	CVE-2019-12696	2 Oct 201919:15	–	nvd
OSV	CVE-2019-12696	2 Oct 201919:15	–	osv
Prion	Design/Logic Flaw	2 Oct 201919:15	–	prion
Vulnrichment	CVE-2019-12696 Cisco Firepower System Software Detection Engine RTF and RAR Malware and File Policy Bypass Vulnerabilities	2 Oct 201919:06	–	vulnrichment

Vulners

Node

cisco_systems firepower_system_softwareRange<6.2.3.15

OR

cisco_systems firepower_system_softwareRange6.3.0–6.3.0.5

OR

cisco_systems firepower_system_softwareRange6.4.0–6.4.0.6

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-firepwr-bypass
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-12696
nvd	www.nvd.nist.gov/vuln/detail

19 Nov 2019 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 25

CVSS 35.8

EPSS0.01455

Cisco Firepower malware detection input validation security policy bypass Rich Text Format RAR archive