Cisco Firepower Threat Defense Software File Policy Bypass Vulnerability

A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the configured file policies on an affected system.

The vulnerability is due to errors when handling specific SSL/TLS messages. An attacker could exploit this vulnerability by sending crafted HTTP packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured file policies and deliver a malicious payload to the protected network.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-ftd-bypass

Security Impact Rating: Medium

CVE: CVE-2019-1970

Related:

  • No Related Posts

Cisco Adaptive Security Appliance Smart Tunnel Vulnerabilities

Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate privileges to the root user or load a malicious library file while the tunnel is being established.

For more information about these vulnerabilities, see the Details section of this security advisory.

Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-asa-multi

Security Impact Rating: Medium

CVE: CVE-2019-1944,CVE-2019-1945

Related:

  • No Related Posts

Cisco IoT Field Network Director TLS Renegotiation Denial of Service Vulnerability

A vulnerability in the web interface of Cisco IoT Field Network Director could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service (DoS) condition on an affected device.

The vulnerability is due to improper handling of Transport Layer Security (TLS) renegotiation requests. An attacker could exploit this vulnerability by sending renegotiation requests at a high rate. A successful exploit could increase the resource usage on the system, eventually leading to a DoS condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-fnd-dos

Security Impact Rating: Medium

CVE: CVE-2019-1957

Related:

  • No Related Posts

Cisco Email Security Appliance Header Injection Vulnerability

A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device.

The vulnerability is due to incomplete input and validation checking mechanisms for certain SPF messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. A successful exploit could allow the attacker to bypass the header filters that are configured for the affected device, which could allow malicious content to pass through the device.

There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-esm-inject

Security Impact Rating: Medium

CVE: CVE-2019-1955

Related:

  • No Related Posts

Cisco Adaptive Security Appliance Software Web-Based Management Interface Privilege Escalation Vulnerability

A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to elevate privileges and execute administrative functions on an affected device.

The vulnerability is due to insufficient authorization validation. An attacker could exploit this vulnerability by logging in to an affected device as a low-privileged user and then sending specific HTTPS requests to execute administrative functions using the information retrieved during initial login.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-asa-privescala

Security Impact Rating: High

CVE: CVE-2019-1934

Related:

  • No Related Posts

Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities

Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the underlying operating system (OS) of an affected device.

For more information about these vulnerabilities, see the Details section of this advisory.

Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-read

Security Impact Rating: Medium

CVE: CVE-2019-1959,CVE-2019-1960

Related:

  • No Related Posts

The FCA declares Bitcoin and Ether require no Regulation

The Financial Conduct Authority (FCA), the U.K.’s top financial regulatory body announced Bitcoin and Ethereum free from regulations on Wednesday. The authority stated that virtual currencies like Bitcoin and Ethereum would not fall within the regulatory jurisdiction of the FCA.

Following the document released by the FCA in January, it is now simplified that the authority views Bitcoin and Ether as decentralized exchange tokens. The report was titled “PS19/22: Guidance on Cryptoassets” and showcased the rules in the consultation paper 19 (CP19). The FCA reported that the majority of the responses confirmed the document.

Regulation continues for security and utility tokens.

On the other hand, the top watchdog did declare the provision of security and utility tokens as they come within the organization’s sphere. According to FCA, “security tokens are similar to securities such as shares and debt instruments,” and can be regulated if the authority marks it as a priority.

FCA had worked throughout 2018-2019 to break on unlicensed crypto-investment plans and scam projects. They wrote, “Any token that is not a security token, or an e-money token is unregulated. However, market participants should note certain activities that use tokens nevertheless be regulated, for example, when used to facilitate regulated payments.”

The regulatory service advised market participants to use guidance to understand crypto-assets. Christopher Woolard, FCA executive director of Strategy and Competition, quoted, “This is a small, complex and evolving market covering a broad range of activities. Today’s guidance will help clarify which crypto-asset activities fall inside our regulatory perimeter.”

Related:

  • No Related Posts

Blocking “Web Ads/Analytics” in ProxySG

I do not need a solution (just sharing information)

Our security team spends quite a bit of time chasing down malicious Javascript, redirects, etc that originate from ad networks.  Ideally we’d like to block the “Web Ads/Analytics” category,   but there’s been hesitation because this category is so broad and makes up a large portion of our overall traffic.   

Has anyone succesfully or unsuccesfully blocked this category at their organization?  Any insight you can provide regarding your experience would be appreciated.

0

Related:

  • No Related Posts