A vulnerability in the TCP proxy functionality for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to an error in TCP-based packet inspection, which could cause the TCP packet to have an invalid Layer 2 (L2)-formatted header. An attacker could exploit this vulnerability by sending a crafted TCP packet sequence to the targeted device. A successful exploit could allow the attacker to cause a DoS condition.

A vulnerability in the TCP proxy functionality for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to restart unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to an error in TCP- based packet inspection, which could cause the TCP packet to have an invalid Layer 2 (L2)-formatted header. An attacker could exploit this vulnerability by sending a crafted TCP packet sequence to the targeted device. A successful exploit could allow the attacker to cause a DoS condition.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by following vulnerabilities:

  - A vulnerability in the TCP ingress handler for the data interfaces that are configured with management     access to Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to     cause an increase in CPU and memory usage, resulting in a denial of service (DoS) condition. The     vulnerability is due to insufficient ingress TCP rate limiting for TCP ports 22 (SSH) and 443 (HTTPS). An     attacker could exploit this vulnerability by sending a crafted, steady stream of TCP traffic to port 22 or     443 on the data interfaces that are configured with management access to the affected device.
    (CVE-2018-15462)

  - A vulnerability in the TCP proxy functionality for Cisco Firepower Threat Defense (FTD) Software could     allow an unauthenticated, remote attacker to cause the device to restart unexpectedly, resulting in a     denial of service (DoS) condition. The vulnerability is due to an error in TCP-based packet inspection,     which could cause the TCP packet to have an invalid Layer 2 (L2)-formatted header. An attacker could     exploit this vulnerability by sending a crafted TCP packet sequence to the targeted device. A successful     exploit could allow the attacker to cause a DoS condition. (CVE-2019-1687)

  - A vulnerability in the TCP processing engine of Cisco Firepower Threat Defense (FTD) Software could allow     an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of     service (DoS) condition. The vulnerability is due to the improper handling of TCP traffic. An attacker who     is using a TCP protocol that is configured for inspection could exploit this vulnerability by sending a     specific sequence of packets at a high rate through an affected device. A successful exploit could allow     the attacker to temporarily disrupt traffic through the device while it reboots. (CVE-2019-1694)

Please see the included Cisco BIDs and Cisco Security Advisory for more information

ID	Name	Product	Family	Type	Severity
506075	Cisco ASA Improper Input Validation (CVE-2019-1687)	Tenable OT Security	Tenable.ot	Remote	high
125256	Cisco Firepower Threat Defense Software 6.x < 6.2.3.12 / 6.3.x < 6.3.0.3 Multiple Vulnerabilities	Nessus	CISCO	Local	high

Detections

Analytics

CVE-2019-1687

high

Tenable Plugins

high

high