Cisco FirePOWER 7000 and Cisco FirePOWER 8000 Series Inspection Engine Stall Vulnerability

A vulnerability in FireSIGHT System Software for Cisco FirePOWER 7000 Series and Cisco FirePOWER 8000 Series devices could allow an unauthenticated, adjacent attacker to cause the inspection engine to stop processing packets. Depending on the affected system configuration, this may cause traffic not to be inspected or to be dropped.

The vulnerability is due to improper parsing of crafted packets. An attacker could exploit this vulnerability by sending crafted packets to the affected system.

Cisco has confirmed the vulnerability and released software updates.

To exploit this vulnerability, an attacker must have access to the same broadcast or collision domain as the targeted device. This access requirement may reduce the likelihood of a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

Cisco Sourcefire 7000 and Cisco Sourcefire 8000 Series devices have been renamed Cisco FirePOWER 7000 and Cisco FirePOWER 8000 Series.