Multiple Cisco Products Snort TCP Fast Open File Policy Bypass Vulnerability
Cisco Security Advisory
Emergency Support:
+1 877 228 7302 (toll-free within North America)
+1 408 525 6532 (International direct-dial)
Non-emergency Support:
Email: psirt@cisco.com
Support requests that are received via e-mail are typically acknowledged within 48 hours.
Cisco product security incident response is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. The on-call Cisco PSIRT works 24x7 with Cisco customers, independent security researchers, consultants, industry organizations, and other vendors to identify possible security issues with Cisco products and networks.
More information can be found in Cisco Security Vulnerability Policy available at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html
cisco-sa-snort-tfo-bypass-MmzZrtes
Final
1.2
1.0
2021-01-11T17:52:35
Initial public release.
1.1
2021-03-30T14:15:12
Added FTD and Snort 3 information. Added Catalyst products. Added Cisco FTD Release 6.7.0 workaround.
1.2
2021-05-20T13:27:19
Updated fixed release information for FTD.
2021-01-13T16:00:00
2021-05-20T13:27:19
TVCE
Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP.
The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.
Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-tfo-bypass-MmzZrtes ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-tfo-bypass-MmzZrtes"]
At the time of publication, this vulnerability affected the following Cisco products if they were running releases earlier than the first fixed release of Cisco software:
3000 Series Industrial Security Appliances (ISAs)
Firepower Threat Defense (FTD) Software
Meraki MX64
Meraki MX64W
Meraki MX67
Meraki MX67C
Meraki MX67W
Meraki MX68
Meraki MX68CW
Meraki MX68W
Meraki MX84
Meraki MX100
Meraki MX250
Meraki MX450
At the time of publication, this vulnerability affected the following Cisco products if they were running releases earlier than the first fixed release of Cisco UTD Snort IPS Engine Software for IOS XE or Cisco UTD Engine for IOS XE SD-WAN Software:
1000 Series Integrated Services Routers (ISRs)
4000 Series ISRs
Catalyst 8000V Edge Software
Catalyst 8200 Series Edge Platforms
Catalyst 8300 Series Edge Platforms
Catalyst 8500L Edge Platforms
Cloud Services Router 1000V (CSR 1000V)
Integrated Services Virtual Router (ISRv)
For information about which Cisco software releases are vulnerable, see the Fixed Software ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort_filepolbypass-m4X5DgOP#fs"] section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.
At the time of publication, this vulnerability also affected all open source Snort project releases earlier than Release 2.9.17. For more information about open source Snort project releases, see the Snort website ["https://www.snort.org/"].
Only products listed in the Vulnerable Products ["#vp"] section of this advisory are known to be affected by this vulnerability.
Cisco has confirmed that this vulnerability does not affect the following Cisco products:
Adaptive Security Appliance (ASA) Software
Catalyst 8500 Edge Platforms
Firepower Management Center (FMC) Software
Meraki vMX100 Virtual Appliances
Meraki Z1 Appliances
Meraki Z3 Series Appliances
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Cisco FTD Software Release 6.7.0
For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert.
Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7.
Log in to the Admin Portal for the FTD deployment.
Navigate to Policies > Intrusion.
Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version.
Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7.
Log in to the Admin Portal for the FTD deployment.
Navigate to Policies > Intrusion.
Choose any system-provided policy, such as Balanced Security and Connectivity.
Search for rule 129:2.
Check the check box next to the rule to enable it.
Choose Drop from the Action drop-down list.
Add the intrusion policy to a rule in Access control policy.
When considering software upgrades ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page ["https://www.cisco.com/go/psirt"], to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Fixed Releases
At the time of publication, the following fixed release information was available for the products that were affected by this vulnerability. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information. For more information about open source Snort project releases, see the Snort website ["https://www.snort.org/"].
Cisco FTD releases 6.4.0.12, 6.6.3, and 6.7.0 and later contained the fix for this vulnerability when the Snort 2 option is configured.
Cisco FTD releases 6.7.0 and later were not vulnerable when the Snort 3 option is configured and rule 129:2 is enabled to drop traffic.
Cisco UTD Snort IPS Engine Software for IOS XE 16.12.5, 17.3.3, and 17.4.11 contained the fix for this vulnerability.
Cisco had not released software updates that address this vulnerability for Meraki MX Series Security Appliances.
The open source Snort project releases 2.9.17 and later contained the fix for this vulnerability.
The open source Snort project releases 3.0 and later were not vulnerable when rule 129:2 is enabled to drop traffic.
1. Starting in 17.2.1, Cisco IOS XE and IOS XE SD-WAN use the same image file.
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
Cisco would like to thank Guillermo Muñoz Mozos of BBVA for reporting this vulnerability.
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-tfo-bypass-MmzZrtes
Multiple Cisco Products Snort TCP Fast Open File Policy Bypass Vulnerability
Cisco Firepower Threat Defense Software 6.2.3
Cisco Firepower Threat Defense Software 6.2.3.1
Cisco Firepower Threat Defense Software 6.2.3.2
Cisco Firepower Threat Defense Software 6.2.3.3
Cisco Firepower Threat Defense Software 6.2.3.4
Cisco Firepower Threat Defense Software 6.2.3.5
Cisco Firepower Threat Defense Software 6.2.3.6
Cisco Firepower Threat Defense Software 6.2.3.7
Cisco Firepower Threat Defense Software 6.2.3.8
Cisco Firepower Threat Defense Software 6.2.3.10
Cisco Firepower Threat Defense Software 6.2.3.11
Cisco Firepower Threat Defense Software 6.2.3.9
Cisco Firepower Threat Defense Software 6.2.3.12
Cisco Firepower Threat Defense Software 6.2.3.13
Cisco Firepower Threat Defense Software 6.2.3.14
Cisco Firepower Threat Defense Software 6.2.3.15
Cisco Firepower Threat Defense Software 6.2.3.16
Cisco Firepower Threat Defense Software 6.6.0
Cisco Firepower Threat Defense Software 6.6.0.1
Cisco Firepower Threat Defense Software 6.6.1
Cisco Firepower Threat Defense Software 6.6.3
Cisco Firepower Threat Defense Software 6.4.0
Cisco Firepower Threat Defense Software 6.4.0.1
Cisco Firepower Threat Defense Software 6.4.0.3
Cisco Firepower Threat Defense Software 6.4.0.2
Cisco Firepower Threat Defense Software 6.4.0.4
Cisco Firepower Threat Defense Software 6.4.0.5
Cisco Firepower Threat Defense Software 6.4.0.6
Cisco Firepower Threat Defense Software 6.4.0.7
Cisco Firepower Threat Defense Software 6.4.0.8
Cisco Firepower Threat Defense Software 6.4.0.9
Cisco Firepower Threat Defense Software 6.4.0.10
Cisco Firepower Threat Defense Software 6.4.0.11
Cisco Firepower Threat Defense Software Platform Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software Platform Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software Platform Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software Platform Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software Platform Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software Platform Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software
Cisco UTD SNORT IPS Engine Software
Cisco Firepower Threat Defense Software 6.2.3 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.1 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.1 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.1 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.1 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.2 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.2 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.2 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.2 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.3 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.3 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.3 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.3 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.4 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.4 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.4 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.4 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.4 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.5 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.5 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.5 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.5 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.5 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.6 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.6 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.6 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.6 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.6 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.7 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.7 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.7 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.7 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.7 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.8 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.8 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.8 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.8 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.8 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.10 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.10 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.10 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.10 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.10 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.11 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.11 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.11 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.11 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.11 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.9 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.9 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.9 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.9 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.9 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.12 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.12 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.12 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.12 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.12 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.13 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.13 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.13 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.13 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.13 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.14 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.14 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.14 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.14 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.14 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.15 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.15 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.15 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.15 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.15 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.2.3.16 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.2.3.16 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.2.3.16 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.2.3.16 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.2.3.16 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.6.0 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.6.0 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.6.0 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.6.0 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.6.0 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.6.0 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.6.0.1 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.6.0.1 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.6.0.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.6.0.1 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.6.0.1 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.6.0.1 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.6.1 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.6.1 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.6.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.6.1 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.6.1 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.6.1 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.6.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.4.0 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.4.0 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.4.0 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.4.0 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.4.0.1 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.4.0.1 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0.1 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.4.0.1 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.4.0.1 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.4.0.3 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.4.0.3 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.4.0.3 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0.3 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.4.0.3 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.4.0.3 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.4.0.2 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.4.0.2 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.4.0.2 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0.2 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.4.0.2 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.4.0.2 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.4.0.4 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.4.0.4 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.4.0.4 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0.4 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.4.0.4 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.4.0.4 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.4.0.5 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.4.0.5 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.4.0.5 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0.5 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.4.0.5 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.4.0.5 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.4.0.6 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.4.0.6 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.4.0.6 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0.6 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.4.0.6 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.4.0.6 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.4.0.7 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.4.0.7 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.4.0.7 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0.7 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.4.0.7 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.4.0.7 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.4.0.8 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.4.0.8 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.4.0.8 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0.8 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.4.0.8 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.4.0.8 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.4.0.9 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.4.0.9 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.4.0.9 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0.9 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.4.0.9 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.4.0.9 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.4.0.10 when installed on Cisco Firepower 2100 Series
Cisco Firepower Threat Defense Software 6.4.0.10 when installed on Cisco Firepower 1000 Series
Cisco Firepower Threat Defense Software 6.4.0.10 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Cisco Firepower Threat Defense Software 6.4.0.10 when installed on Cisco Firepower 9000 Series
Cisco Firepower Threat Defense Software 6.4.0.10 when installed on Cisco Firepower 4100 Series
Cisco Firepower Threat Defense Software 6.4.0.10 when installed on Cisco Secure Firewall Threat Defense Virtual
Cisco Firepower Threat Defense Software 6.4.0.11 when installed on Cisco 3000 Series Industrial Security Appliances (ISA)
Multiple Cisco Products SNORT Tcp Fast Open File Policy Bypass Vulnerability
CSCvt43136
CSCvt43136,CSCvu88532
Complete.
CVE-2021-1224
CVRFPID-220203
CVRFPID-225862:277392
CVRFPID-225862:277393
CVRFPID-225862:277438
CVRFPID-225862:277440
CVRFPID-225862:277441
CVRFPID-225862:277464
CVRFPID-233334:277392
CVRFPID-233334:277438
CVRFPID-233334:277440
CVRFPID-233334:277441
CVRFPID-233334:277464
CVRFPID-245396:277392
CVRFPID-245396:277438
CVRFPID-245396:277440
CVRFPID-245396:277441
CVRFPID-245396:277464
CVRFPID-245397:277392
CVRFPID-245397:277438
CVRFPID-245397:277440
CVRFPID-245397:277441
CVRFPID-245397:277464
CVRFPID-245398:277392
CVRFPID-245398:277438
CVRFPID-245398:277440
CVRFPID-245398:277441
CVRFPID-245398:277464
CVRFPID-247893:277392
CVRFPID-247893:277438
CVRFPID-247893:277440
CVRFPID-247893:277441
CVRFPID-247893:277464
CVRFPID-247894:277392
CVRFPID-247894:277438
CVRFPID-247894:277440
CVRFPID-247894:277441
CVRFPID-247894:277464
CVRFPID-248816:277392
CVRFPID-248816:277438
CVRFPID-248816:277440
CVRFPID-248816:277441
CVRFPID-248816:277464
CVRFPID-251756:277392
CVRFPID-251756:277438
CVRFPID-251756:277440
CVRFPID-251756:277441
CVRFPID-251756:277464
CVRFPID-251757:277392
CVRFPID-251757:277438
CVRFPID-251757:277440
CVRFPID-251757:277441
CVRFPID-251757:277464
CVRFPID-258063:277392
CVRFPID-258063:277438
CVRFPID-258063:277440
CVRFPID-258063:277441
CVRFPID-258063:277464
CVRFPID-258064:277392
CVRFPID-258064:277438
CVRFPID-258064:277440
CVRFPID-258064:277441
CVRFPID-258064:277464
CVRFPID-258915:277392
CVRFPID-258915:277438
CVRFPID-258915:277440
CVRFPID-258915:277441
CVRFPID-258915:277464
CVRFPID-265011:277392
CVRFPID-265011:277438
CVRFPID-265011:277440
CVRFPID-265011:277441
CVRFPID-265011:277464
CVRFPID-265014:277392
CVRFPID-265014:277393
CVRFPID-265014:277438
CVRFPID-265014:277440
CVRFPID-265014:277441
CVRFPID-265014:277464
CVRFPID-265015:277392
CVRFPID-265015:277438
CVRFPID-265015:277440
CVRFPID-265015:277441
CVRFPID-265015:277464
CVRFPID-265950:277392
CVRFPID-265950:277393
CVRFPID-265950:277438
CVRFPID-265950:277440
CVRFPID-265950:277441
CVRFPID-265950:277464
CVRFPID-267675:277392
CVRFPID-267675:277438
CVRFPID-267675:277440
CVRFPID-267675:277441
CVRFPID-267675:277464
CVRFPID-267676:277392
CVRFPID-267676:277438
CVRFPID-267676:277440
CVRFPID-267676:277441
CVRFPID-267676:277464
CVRFPID-268602:277392
CVRFPID-268602:277393
CVRFPID-268602:277438
CVRFPID-268602:277440
CVRFPID-268602:277441
CVRFPID-268602:277464
CVRFPID-275475:277392
CVRFPID-275475:277438
CVRFPID-275475:277440
CVRFPID-275475:277441
CVRFPID-275475:277464
CVRFPID-276372:277392
CVRFPID-276372:277393
CVRFPID-276372:277438
CVRFPID-276372:277440
CVRFPID-276372:277441
CVRFPID-276372:277464
CVRFPID-276373:277392
CVRFPID-276373:277393
CVRFPID-276373:277438
CVRFPID-276373:277440
CVRFPID-276373:277441
CVRFPID-276373:277464
CVRFPID-276933:277392
CVRFPID-276933:277393
CVRFPID-276933:277438
CVRFPID-276933:277440
CVRFPID-276933:277441
CVRFPID-276933:277464
CVRFPID-276934:277392
CVRFPID-276934:277393
CVRFPID-276934:277438
CVRFPID-276934:277440
CVRFPID-276934:277441
CVRFPID-276934:277464
CVRFPID-276935:277392
CVRFPID-276935:277393
CVRFPID-276935:277438
CVRFPID-276935:277440
CVRFPID-276935:277441
CVRFPID-276935:277464
CVRFPID-278397:277392
CVRFPID-278397:277393
CVRFPID-278397:277438
CVRFPID-278397:277440
CVRFPID-278397:277441
CVRFPID-278397:277464
CVRFPID-278503:277392
CVRFPID-278503:277438
CVRFPID-278503:277440
CVRFPID-278503:277441
CVRFPID-278503:277464
CVRFPID-278885:277392
CVRFPID-278885:277393
CVRFPID-278885:277438
CVRFPID-278885:277440
CVRFPID-278885:277441
CVRFPID-278885:277464
CVRFPID-280013:277392
CVRFPID-280013:277393
CVRFPID-280013:277438
CVRFPID-280013:277440
CVRFPID-280013:277441
CVRFPID-280013:277464
CVRFPID-280662:277392
CVRFPID-280662:277393
CVRFPID-280662:277438
CVRFPID-280662:277440
CVRFPID-280662:277441
CVRFPID-280662:277464
CVRFPID-280999:277438
CVRFPID-281981:277438
CVRFPID-279755
5.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Cisco FTD Software Release 6.7.0
For Cisco FTD Software Release 6.7.0, as a workaround when the Snort 3 configuration option is enabled, an administrator may enable built-in rule 129:2 in the intrusion policy and set the action to Drop instead of Alert.
Use the following steps to verify that the Snort 3 configuration option is enabled. For more details, see the Switching Between Snort 2 and Snort 3 ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#id_120089"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7.
Log in to the Admin Portal for the FTD deployment.
Navigate to Policies > Intrusion.
Look for the Snort Version line above the table. The current version is the first number in the complete version number. For example, 2.9.17-95 is a Snort 2 version.
Use the following steps to enable rule 129:2. For more details, see the Changing Intrusion Rule Actions (Snort 3) ["https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-intrusion.html#Cisco_Task_in_List_GUI.dita_54aef253-02ab-4044-88ea-cea05249686d"] section of the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 6.7.
Log in to the Admin Portal for the FTD deployment.
Navigate to Policies > Intrusion.
Choose any system-provided policy, such as Balanced Security and Connectivity.
Search for rule 129:2.
Check the check box next to the rule to enable it.
Choose Drop from the Action drop-down list.
Add the intrusion policy to a rule in Access control policy.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-tfo-bypass-MmzZrtes
Multiple Cisco Products Snort TCP Fast Open File Policy Bypass Vulnerability