CVE-2018-0243 : Security Advisory and Response

A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action policy that is intended to drop the Server Message Block Version 2 (SMB2) and SMB Version 3 (SMB3) protocols if malware is detected.

Understanding CVE-2018-0243

This CVE involves a flaw in the detection engine of Cisco Firepower System Software that could be exploited by an unauthorized remote attacker.

What is CVE-2018-0243?

The vulnerability allows attackers to bypass a configured file action policy designed to drop SMB2 and SMB3 protocols if malware is detected, potentially enabling the passage of malware.

The Impact of CVE-2018-0243

Unauthorized remote attackers can exploit the flaw to circumvent file action policies, potentially allowing the passage of malware.
The vulnerability affects Cisco Firepower System Software releases prior to 6.2.3.

Technical Details of CVE-2018-0243

The technical aspects of the vulnerability in Cisco Firepower System Software.

Vulnerability Description

Incorrect detection of SMB2 or SMB3 files based on total file length.
Attackers can send crafted SMB2 or SMB3 transfer requests to exploit the vulnerability.

Affected Systems and Versions

Cisco Firepower System Software releases prior to 6.2.3.

Exploitation Mechanism

Attackers send specifically crafted SMB2 or SMB3 transfer requests through the targeted device.
Successful exploitation allows bypassing configured blocking of SMB2 or SMB3 files.

Mitigation and Prevention

Steps to mitigate and prevent the CVE-2018-0243 vulnerability.

Immediate Steps to Take

Update Cisco Firepower System Software to version 6.2.3 or later.
Monitor network traffic for any suspicious SMB2 or SMB3 transfer requests.

Long-Term Security Practices

Regularly update and patch software to prevent vulnerabilities.
Implement network segmentation to limit the impact of potential attacks.

Patching and Updates

Apply patches and updates provided by Cisco to address the vulnerability.