Cisco has released software updates to patch a high severity vulnerability that allows remote attackers to bypass the malware detection and blocking feature in the Firepower System Software.
The vulnerability, tracked as CVE-2016-1345, is caused by improper input validation of fields in HTTP headers. A remote, unauthenticated attacker can exploit the flaw to bypass malicious file detection and blocking features by sending a specially crafted HTTP request to the targeted system.
According to Cisco, successful exploitation of the vulnerability allows malware to pass through the system without being detected.
The issue affects various Cisco security appliances running Firepower System Software with file action policies configured. The list of affected products includes Adaptive Security Appliance (ASA), Advanced Malware Protection (AMP), Sourcefire 3D System, FirePOWER, and Next Generation Intrusion Prevention Systems for VMware (NGIPSv) and Blue Coat X-Series (NGIPS).
The vulnerability has been patched in Cisco Firepower System Software 5.4.0.7 and later, 5.4.1.6 and later, and 6.0.1 and later.
The networking giant noted that the security hole also affects Snort, the company’s open source intrusion prevention system. The issue has been resolved in Snort with the release of version 2.9.8.2 on Wednesday.
The flaw was reported to Cisco by Dikla Barda, Liad Mizrachi, and Oded Vanunu from Check Point Security. The company says it’s unaware of any instances where the vulnerability has been exploited for malicious purposes.
Cisco has already published nearly 30 advisories this year to describe high and critical severity vulnerabilities plaguing the company’s products.
Related: Cisco Patches Critical, High Severity Flaws in NX-OS
Related: Cisco Patches Serious DoS Flaws in IOS Software
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
Latest News
- Chrome 114 Released With 18 Security Fixes
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
- Breaking Enterprise Silos and Improving Protection
- Spyware Found in Google Play Apps With Over 420 Million Downloads
- Millions of WordPress Sites Patched Against Critical Jetpack Vulnerability
- Barracuda Zero-Day Exploited to Deliver Malware for Months Before Discovery
- PyPI Enforcing 2FA for All Project Maintainers to Boost Security
- Personal Information of 9 Million Individuals Stolen in MCNA Ransomware Attack
