CVE-2017-3870 : What You Need to Know

A vulnerability in the URL filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) allows remote attackers to bypass configured URL filter rules.

Understanding CVE-2017-3870

What is CVE-2017-3870?

A flaw in the URL filtering functionality of Cisco AsyncOS Software for Cisco WSA enables remote attackers to bypass URL filter rules without authentication.

The Impact of CVE-2017-3870

This vulnerability affects all versions of Cisco AsyncOS Software for Cisco WSA before the first fixed release, impacting both virtual and hardware appliances with URL filters set up for email scanning.

Technical Details of CVE-2017-3870

Vulnerability Description

The flaw in URL filtering could allow unauthenticated remote attackers to bypass configured URL filter rules.

Affected Systems and Versions

Cisco Web Security Appliance versions 8.5.3-069, 9.1.1-074, and 9.1.2-010 are confirmed to be affected.

Exploitation Mechanism

Attackers can exploit this vulnerability to bypass URL filter rules without authentication.

Mitigation and Prevention

Immediate Steps to Take

Apply the necessary patches provided by Cisco to fix the vulnerability.
Monitor Cisco's security advisories for updates and follow best practices for secure configuration.

Long-Term Security Practices

Regularly update and patch Cisco Web Security Appliance software to prevent vulnerabilities.

Patching and Updates

Ensure all Cisco Web Security Appliance installations are updated to the latest fixed release to mitigate the risk of URL filtering bypass.