Cisco Firewall Services Module HTTPS Traffic Temporary Denial of Service Vulnerability

Cisco Firewall Services Module versions versions prior to 3.1(3.11) contain a vulnerability that could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition.

The vulnerability is due to an error when the embedded HTTPS server handles certain types of requests. An unauthenticated, remote attacker could exploit this vulnerability by submitting crafted HTTPS request directly to the Cisco Firewall Services Module. This action could cause the device to reload, resulting in a temporary DoS condition.

Cisco has confirmed this vulnerability with a security advisory and released updated software.

A successful attack allows the attacker to cause the Cisco Firewall Services Module to reload. The device will automatically restart, allowing the attacker to cause only a temporary DoS condition. Because the vulnerability requires a malformed HTTPS request, a custom application will be required to exploit the vulnerability. This makes it unlikely that a standard web browser can be utilized.

This vulnerability may also be accidentally exploited by legitimate traffic from a third-party vulnerability scanner.