CVE-2017-12245 : What You Need to Know

A weakness has been identified in the decryption of SSL traffic in Cisco Firepower Threat Defense (FTD) Software, leading to a vulnerability known as the Firepower Detection Engine SSL Decryption Memory Consumption Denial of Service. This CVE affects various Cisco products and could result in a denial of service scenario.

Understanding CVE-2017-12245

This CVE pertains to a vulnerability in SSL traffic decryption in Cisco Firepower Threat Defense (FTD) Software, potentially allowing remote attackers to exhaust system memory.

What is CVE-2017-12245?

The vulnerability in SSL traffic decryption for Cisco Firepower Threat Defense (FTD) Software could be exploited by remote attackers to cause memory depletion, potentially leading to a denial of service situation.

The Impact of CVE-2017-12245

Exploitation of this vulnerability could exhaust system memory, resulting in a denial of service scenario where traffic is no longer forwarded through the affected device.

Technical Details of CVE-2017-12245

This section provides detailed technical information about the CVE.

Vulnerability Description

The vulnerability arises from an error in the handling of SSL traffic decryption and notifications by the Firepower Detection Snort Engine in conjunction with the Adaptive Security Appliance (ASA) handler.

Affected Systems and Versions

Cisco Firepower Threat Defense (FTD) Software Releases 6.0.1 and later
Cisco products including ASA 5500-X Series Next-Generation Firewalls, Firepower 2100 Series Security Appliances, Firepower 4100 Series Security Appliances, and Firepower 9300 Series Security Appliances

Exploitation Mechanism

Attackers exploit the vulnerability by continuously transmitting malicious SSL traffic through the device, causing a memory leak and potential denial of service.

Mitigation and Prevention

Steps to address and prevent the CVE.

Immediate Steps to Take

Apply vendor-provided patches and updates promptly
Monitor system memory usage for any unusual spikes
Implement network traffic monitoring and filtering to detect and block malicious SSL traffic

Long-Term Security Practices

Regularly update and patch software and firmware to address known vulnerabilities
Conduct security assessments and penetration testing to identify and mitigate potential weaknesses

Patching and Updates

Refer to vendor advisories for patch availability and apply updates as soon as possible