Tag: https

Multiple Cisco Products Server Name Identification Data Exfiltration Vulnerability

Cisco Leave a comment

A vulnerability in Server Name Identification (SNI) request filtering of Cisco Web Security Appliance (WSA), Cisco Firepower Threat Defense (FTD), and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from a compromised host.

This vulnerability is due to inadequate filtering of the SSL handshake. An attacker could exploit this vulnerability by using data from the SSL client hello packet to communicate with an external server. A successful exploit could allow the attacker to execute a command-and-control attack on a compromised host and perform additional data exfiltration attacks.

There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sni-data-exfil-mFgzXqLN

Security Impact Rating: Medium

CVE: CVE-2021-34749

Related:

  • No Related Posts

ADM and Director Intergration missing Network HDX data: Error “No details are available” or blank page

Citrix Leave a comment
Running Citrix ADM 13.0 (latest) and attempting to integrated the network function into our Citrix Director 1912.

Attempted to use both HTTP and HTTPS.

WIth HTTP the network tab on director is blank.

With HTTPS it say no details are available.

The following guide was used: https://docs.citrix.com/en-us/xenapp-and-xendesktop/7-15-ltsr/director/hdx-insight.html

Using HTTPS ::

Using HTTPS

Network capture trace shows Director Servers sends a FIN and interrupt TLS Handshake with ADM Server.

TLS flow Request from ADM Server

==========================

Transport Layer Security

TLSv1.2 Record Layer: Handshake Protocol: New Session Ticket

Content Type: Handshake (22)

Version: TLS 1.2 (0x0303)

Length: 170

Handshake Protocol: New Session Ticket

TLSv1.2 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec

Content Type: Change Cipher Spec (20)

Version: TLS 1.2 (0x0303)

Length: 1

Change Cipher Spec Message

TLSv1.2 Record Layer: Handshake Protocol: Encrypted Handshake Message

Content Type: Handshake (22)

Version: TLS 1.2 (0x0303)

Length: 96

Handshake Protocol: Encrypted Handshake Message

Response TLS from Director Server

==========================

Transmission Control Protocol, Src Port: 52282, Dst Port: 443, Seq: 342, Ack: 4300, Len: 0

Source Port: 52282

Destination Port: 443

[Stream index: 0]

[TCP Segment Len: 0]

Sequence Number: 342 (relative sequence number)

Sequence Number (raw): 1163837986

[Next Sequence Number: 343 (relative sequence number)]

Acknowledgment Number: 4300 (relative ack number)

Acknowledgment number (raw): 1444382645

0101 …. = Header Length: 20 bytes (5)

Flags: 0x011 (FIN, ACK)

Window: 512

[Calculated window size: 131072]

[Window size scaling factor: 256]

Checksum: 0xb928 [unverified]

[Checksum Status: Unverified]

Urgent Pointer: 0

[SEQ/ACK analysis]

[Timestamps]

When using HTTP :: Browser shows a blank page, no errors or details.

Related:

  • No Related Posts

ADM and Director Intergration missing Network HDX data :: Error “No details are available” or blank page

Citrix Leave a comment
Running Citrix ADM 13.0 (latest) and attempting to integrated the network function into our Citrix Director 1912.

Attempted to use both HTTP and HTTPS.

WIth HTTP the network tab on director is blank.

With HTTPS it say no details are available.

The following guide was used: https://docs.citrix.com/en-us/xenapp-and-xendesktop/7-15-ltsr/director/hdx-insight.html

Using HTTPS ::

Using HTTPS

Network capture trace shows Director Servers sends a FIN and interrupt TLS Handshake with ADM Server.

TLS flow Request from ADM Server

==========================

Transport Layer Security

TLSv1.2 Record Layer: Handshake Protocol: New Session Ticket

Content Type: Handshake (22)

Version: TLS 1.2 (0x0303)

Length: 170

Handshake Protocol: New Session Ticket

TLSv1.2 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec

Content Type: Change Cipher Spec (20)

Version: TLS 1.2 (0x0303)

Length: 1

Change Cipher Spec Message

TLSv1.2 Record Layer: Handshake Protocol: Encrypted Handshake Message

Content Type: Handshake (22)

Version: TLS 1.2 (0x0303)

Length: 96

Handshake Protocol: Encrypted Handshake Message

Response TLS from Director Server

==========================

Transmission Control Protocol, Src Port: 52282, Dst Port: 443, Seq: 342, Ack: 4300, Len: 0

Source Port: 52282

Destination Port: 443

[Stream index: 0]

[TCP Segment Len: 0]

Sequence Number: 342 (relative sequence number)

Sequence Number (raw): 1163837986

[Next Sequence Number: 343 (relative sequence number)]

Acknowledgment Number: 4300 (relative ack number)

Acknowledgment number (raw): 1444382645

0101 …. = Header Length: 20 bytes (5)

Flags: 0x011 (FIN, ACK)

Window: 512

[Calculated window size: 131072]

[Window size scaling factor: 256]

Checksum: 0xb928 [unverified]

[Checksum Status: Unverified]

Urgent Pointer: 0

[SEQ/ACK analysis]

[Timestamps]

When using HTTP :: Browser shows a blank page, no errors or details.

Related:

  • No Related Posts

How to Configure SSL on XenDesktop Controllers to Secure XML Traffic

Citrix Leave a comment

From XenDesktop Controller

IIS Installed on XenDesktop Controller

In this scenario, the XenDesktop controller has IIS installed and functioning to serve Web Interface or other web services. To complete this setup, you must request a Server Certificate and install it on IIS.

There are two ways to generate Server Certificates on IIS 7.x:

  • Create Certificate Request: This generates a CSR file to be submitted to a third party Certification Authority (CA) or to your internal Microsoft CA. For more information, refer to Microsoft TechNet article – Request an Internet Server Certificate (IIS 7)

  • Create Domain Certificate: This generates a CSR file and submits it to your domain registered Microsoft CA server. For more information, refer to the Microsoft TechNet article – Create a Domain Server Certificate on IIS 7.

    User-added image

After the Server Certificate is installed on IIS, ensure to set the Bindings to enable HTTPS on IIS by completing the following procedure:

  1. Select the IIS site that you want to enable HTTPS and select Bindings under Edit Site.

    User-added image

  1. Click Add, select Type as https, port number as 443, select the SSL Certificate that you installed and click OK.

    User-added image

  1. Open Registry Editor on XenDesktop Controller and look for the following key name.

    HKEY_LOCAL_MACHINESOFTWARECitrixDesktopServer.

    Caution! Refer to the Disclaimer at the end of this article before using Registry Editor.

  1. Verify that XmlServicesSslPort registry key exists with the correct value for SSL port. By default, it is set to 443.

    User-added image

  1. Change the XML service port.

    You can do this using PowerShell by running the following command:

    BrokerService –WiSslPort <port number>

    Note    : If you decide to change the XML service port number on XenDesktop Controller, ensure to update the IIS port number as well under Bindings to match the new value.

IIS is not Installed on XenDesktop Controller

In this scenario, the XenDesktop Controller does not have IIS installed. As a result, there are a few ways to obtain a Server Certificate for the Controller:

  • Export an existing Server Certificate from another server in PFX format. When exporting the Server Certificate, ensure to select the private key as well.

  • You can use the Certreq utility from Microsoft to generate a Certificate Signing Request and submit it to a third party CA or your internal Microsoft CA server. For more information, refer to the Microsoft TechNet article – Certreq.exe Syntax.

    Note: Ensure to always import the PFX server certificates under the XenDesktop controller Local Computer certificate store and not My user account.

    User-added image

After the Server Certificate is installed on XenDesktop Controller, register the SSL certificate for HTTPS on the server. To accomplish this, Windows 2008 has a built-in utility called netsh that allows you to bind SSL certificates to a port configuration. For more information, refer to the Microsoft MSDN article – How to: Configure a Port with an SSL Certificate

The following is the command that you must use:

netsh http add sslcert ipport=0.0.0.0:<port Number> certhash=<hash number> appid={XenDesktop Broker Service GUID}

To obtain the certificate hash of a Server Certificate, open the Registry Editor, and open the following key name location and search for the Server Certificate that you want to use:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftSystemCertificatesMYCertificates

User-added image

An alternative to obtain this certificate hash

  1. Open the Server Certificate and under the Details tab, select Thumprint:

    User-added image

  1. Obtain the GUID of the XenDesktop controller Citrix Broker Service.

  2. Open Registry Editor and select Find.

  3. Search for Broker Service words. By default, the location is in HKEY_CLASSES_ROOTInstallerProducts (see the following example):

    User-added image

  1. Now that you have the certificate hash and Citrix Broker Service GUID, you can run the netsh command to bind the SSL certificate to port 443 and Citrix Broker Service. The following example is based on the GUID and certificate hash values taken from the preceding screenshots:

    Here is command to get the GUID

    Run the below command in Elevated command prompt on the DDC

    wmic product where “Name like ‘Citrix Broker Service'” get Name,identifyingnumber

    IdentifyingNumber

    ​C: >netsh http add sslcert ipport=10.12.37.231:443 certhash=298B8AB50322A5A601A57D4976875191D85A2949 appid={13C9D851-5D94-7C44-4A2B-218F89A28DC7}

    Note    : For GUID, ensure to include dashes (-). Otherwise, the command cannot run successfully.

A successful bind looks as displayed in the following screen shot:

User-added image

From the Web Interface server

Configure the XenApp Web Site or XenApp Services Site to use HTTPS and 443 as Transport Type and XML Service port respectively under Server Farms.

User-added image

Note: To have a successful SSL connection to the XenDesktop 5 Controller, ensure that Web Interface has installed the Trusted Root certificate (under Local Computer certificate store).

Related:

  • No Related Posts

Error: “Cannot Complete Your Request” Due to Misconfigured or Expired Certificates on StoreFront

Citrix Leave a comment

Complete the following steps on all the StoreFront servers to troubleshoot this issue:

  1. Open the IIS console > Servername > Server Certificates

1) Make sure the Certificate Issued To name matches the StoreFront Base URL.

2) Make sure the Expiration Date is not expired.

3) View the Certificate Details tab of the certificate, verify it contains a private key. If using a SAN certificate, make sure the StoreFront Base URL is listed under the subject alternative names. Wildcard certificates are also supported.

4) View the Certification Path tab of the certificate, confirm that all the Intermediate and Root certificates are properly installed to complete an SSL Handshake.

For more information regarding Server certificates, refer to Microsoft article

– Server Certificate Deployment

– Configure intermediate certificates on a computer that is running IIS for server authentication

  1. Open the IIS console > Servername > Sites > Default Web Site > Bindings.
1) Make sure there is a binding for HTTPS over port 443.

2) The SSL certificate matches the StoreFront Base URL.

3) The host name field is empty.

For more information regarding adding a binding, refer to Microsoft article – SSL Bindings

Related:

  • No Related Posts

Cisco Adaptive Security Appliance Software SSL/TLS Denial of Service Vulnerability

Cisco Leave a comment

A vulnerability in the SSL/TLS handler of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause the affected device to reload unexpectedly, leading to a denial of service (DoS) condition.

The vulnerability is due to improper error handling on established SSL/TLS connections. An attacker could exploit this vulnerability by establishing an SSL/TLS connection with the affected device and then sending a malicious SSL/TLS message within that connection. A successful exploit could allow the attacker to cause the device to reload.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-dos-7uZWwSEy

Security Impact Rating: High

CVE: CVE-2020-27124

Related:

  • No Related Posts

Cisco Firepower 1000 Series Bleichenbacher Attack Vulnerability

Cisco Leave a comment

A vulnerability in the TLS handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000 Series firewalls could allow an unauthenticated, remote attacker to gain access to sensitive information.

The vulnerability is due to improper implementation of countermeasures against the Bleichenbacher attack for cipher suites that rely on RSA for key exchange. An attacker could exploit this vulnerability by sending crafted TLS messages to the device, which would act as an oracle and allow the attacker to carry out a chosen-ciphertext attack. A successful exploit could allow the attacker to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions to the affected device.

To exploit this vulnerability, an attacker must be able to perform both of the following actions:

  • Capture TLS traffic that is in transit between clients and the affected device
  • Actively establish a considerable number of TLS connections to the affected device

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tls-bb-2g9uWkP

Security Impact Rating: Medium

CVE: CVE-2020-3585

Related:

  • No Related Posts

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Session Denial of Service Vulnerability

Cisco Leave a comment

A vulnerability in the SSL/TLS session handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

The vulnerability is due to a memory leak when closing SSL/TLS connections in a specific state. An attacker could exploit this vulnerability by establishing several SSL/TLS sessions and ensuring they are closed under certain conditions. A successful exploit could allow the attacker to exhaust memory resources in the affected device, which would prevent it from processing new SSL/TLS connections, resulting in a DoS. Manual intervention is required to recover an affected device.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-tcp-dos-N3DMnU4T

This advisory is part of the October 2020 Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication, which includes 17 Cisco Security Advisories that describe 17 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: October 2020 Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication.

Security Impact Rating: High

CVE: CVE-2020-3572

Related:

  • No Related Posts

FAQ: NetScaler Load Balancing/Persistence

Citrix Leave a comment

Q: How does LB slow start work with persistence? When is the slow start exited?

A: By default a newly configured virtual server remains in a Slow Start mode for Startup RR Factor of 100.

If there are 2 services bound to the LB VIP, the LB vServer will exit the slow-start mode after 200 hits. The calculation is PE(n) X service(n) X 100 = 1 X 2 X 100 = 200 (assuming there is one PE).

When Source IP based persistency is configured, the client connections need to hit the LB VIP with different source IP’s. In the above case, if 200 connections are initiated from the same source IP, the counter will only decrement by 1 (with 199 connections remaining). The rest of the 199 connections need to be from unique source IP’s for the NetScaler to exit the slow-start mode and come back to the configured load balancing method

root@netscaler# nsconmsg -K newnslog -d current -s disptime=1 -g vsvr_do_next_rrreq | moreDisplaying performance informationNetScaler V20 Performance DataNetScaler NS11.1: Build 51.21.nc, Date: Dec 22 2016, 12:32:24 14 427000 200 200 28 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:55:59 2017 15 322000 199 -1 0 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 11:01:21 2017 16 1938995 198 -1 0 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 13:15:31 2017 17 14000 197 -1 0 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 13:15:45 2017If the persistence is set to NONE, irrespective of the Source IP's, once the number of connections reaches 200, the slow start is exited 2 223997 200 1 0 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:46:46 2017 3 49000 199 -1 0 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:47:35 2017 4 7000 176 -23 -3 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:47:42 2017 5 7001 163 -13 -1 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:47:49 2017 6 6999 132 -31 -4 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:47:56 2017 7 7000 109 -23 -3 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:48:03 2017 8 7000 89 -20 -2 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:48:10 2017 9 7000 57 -32 -4 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:48:17 2017 10 7000 25 -32 -4 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:48:24 2017 11 7001 23 -2 0 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:48:31 2017 12 14000 13 -10 -1 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:48:45 2017 13 6999 0 -13 -1 vsvr_do_next_rrreq vserver_lb_172.16.181.146:80(LB) Fri Jul 7 10:48:52 2017

Refer to https://support.citrix.com/article/CTX108886 to know more about Slow-Start

Q: A persistence RULE is configured with a persistence timeout of 10 minutes. When “show persistent sessions” command is run for that particular load balancing vServer, many entries with a timeout of 0 (expired) are still see in the output table. What causes this persistence table entries to show even though the timeout has expired?

A: The “show persistence session” output only displays entry from master core and not from peer cores where persistence session is cached.

Even if the timeout value is set to 0 on the master core, the other core still has this session entry with non-zero value due to which the master core does not remove this from its table immediately after it times out.

By design, after the connection is idle and deleted and the persistence timeout has passed, in addition to remaining for 2 minutes due to the relationship between the master core and the peer core, there may be a case in which 120-330 seconds remain for synchronization between NSPPE and internal processing.

Q: LB vServer (HTTP) does not load balance the hits on the vServer correctly when LB method is Least Connection. Uneven number of hits seen on the 2 load balanced backend services.

A: In the “Least Connection” method of load balancing, the number of connections per service is the value that we take into account, not the number of hits to the service.

Q: Does the TCP profile bound on the CS VIP or the corresponding LB VIP takes precedence?

A: NetScaler will use the TCP profile bound on the Content Switch vServer for front-end/client connection

The TCP profile bound to the Load Balancing vServer will not be used if the connection is made through the Content Switching vServer

The TCP profile bound to the Load Balancing vServer will be applied only if the client establishes the connection with the Load Balancing VIP directly

If no TCP profile is bound to the Content Switch vServer, the default TCP profile will be used

Q: Can a VIP address be bound to netprofile/ ipset in Cluster?

A: This is currently not allowed. You will see the error “ERROR: Operation not permitted” while trying to do this. This is supported starting from 11.1 build 58.x and 12.0 build 33.x (Issue ID: 664024)

Q: Are active sessions dropped while disabling a service or a member of a service group?

A: Yes, the active connections are dropped if we do not do a “Graceful” disable of the service. Active connections are maintained if the “Graceful” checkbox is selected.

Traffic Management ->LB-> ServiceGroup-> Manage Member -> Select member then click disable -.> Check Graceful and click ok

Q: What does the “Graceful” option do while disabling a service?

A: This checkbox indicates graceful shutdown of the service. System will wait for all outstanding connections to this service to be closed before disabling the service.

Gracefully disabled services will maintain all current connections until these have timed-out/gracefully closed. All new connections will be sent to the enabled services.

Just disabling the services, will migrate all existing connections to the enabled service

State

Results

Graceful shutdown is enabled and a wait time is specified.

Service is shut down after the last of the current active client connections is served, even if the wait time has not expired. The appliance checks the status of the connections once every second. If the wait time expires, any open sessions are closed.

Graceful shutdown is disabled and a wait time is specified.

Service is shut down only after the wait time expires, even if all established connections are served before expiration.

Graceful shutdown is enabled and no wait time is specified.

Service is shut down only after the last of the previously established connections is served, regardless of the time taken to serve the last connection.

Graceful shutdown is disabled and no wait time is specified.

No graceful shutdown. Service is shut down immediately after the disable option is chosen or the disable command is issued. (The default wait time is zero seconds.)

Q: NS 10.5: NetProfile does not work intermittently and traffic is sourced from the wrong SNIP

A: This has been identified as an issue in the build of 10.5 and is fixed in 11.1 (Issue ID: 536377)

Q: Why does SSL VIP use HTTP/1.1 despite configuring HTTP/2 in the HTTP profile bound?

A: In the SSL handshake, we see in the client hello that client supports http2 over TLS (h2), however the VIP chooses HTTP 1.1.

HTTP/2 only supports TLS version 1.2 or higher for HTTP/2 over TLS (h2). HTTP/2 doesn’t support any of the ciphers suites that are listed in the following article.

https://http2.github.io/http2-spec/#BadCipherSuites

Ensure that HTTP/2 supported Ciphers are bound to the VIP

Q: Can we view SSL counters/ statistics specific to a vServer or a VIP?

A: This is currently not possible. An enhancement request with the Product management has been raised for this:

ENH0234441: Display of per vServer/service stats with “stat ssl” command

ENH0234442: SSL per vServer/service stats should be displayed with nsconmsg -s ConSSL output

Q: What does the spillover count (SO) for a vServer in the ConLb output indicate?

A: If you have spillover configured or have a backup vServer and spillover occurs, they will be sent to the backup and the counter will increment. If you do not have spillover configured or a backup vServer configured, then the connection is reset and the spillover counter will still increment. The incrementing counter is indicative of requests being reset when you have no spillover configured.

When you do have spillover configured and requests are actually being spilled over, the counter is going to increment. Thus the counter increments in either scenario. Hence, if you know you don’t have spillover configured and you see spillover hits, then you should consider setting up spillover so that requests are processed instead of being reset.

Q: What are the ways to protect a Load Balancing vServer against Failure when it goes DOWN?

A: “Disable Primary When Down”: If you want the backup virtual server to remain in control until you manually enable the primary virtual server even if the primary virtual server comes back up, select “Disable Primary When Down”. For more information on “Configuring a Backup Load Balancing Virtual Server” refer docs:

http://docs.citrix.com/en-us/netscaler/11/traffic-management/load-balancing/load-balancing-protect-configuration/config-backup-vserver.html

“Connection fail over”: Connection fail over helps prevent disruption of access to applications deployed in a distributed environment. In a NetScaler High Availability (HA) setup, connection fail over (or connection mirroring-CM) refers to keeping active an established TCP or UDP connection when a fail over occurs. The new primary NetScaler appliance has information about the connections established before the fail over and continues to serve those connections. After failover, the client remains connected to the same physical server. Setup supported for connection failover are Service type –> ANY, UDP, TCP, FTP, SSL_BRIDGE.

For more information on “Connection failover” refer

http://docs.citrix.com/en-us/netscaler/11/traffic-management/load-balancing/load-balancing-protect-configuration/connection-failover.html

Other methods can be viewed in the following link: https://docs.citrix.com/en-us/netscaler/11/traffic-management/load-balancing/load-balancing-protect-configuration.html

Q: Can we integrate MFA with LB vServer?

A: Yes, this can be done by configuring AAA vserver which can be configured as SAML SP. Microsoft MFA can be configured as SAML IDP if it has access to the LDAP/Radius.

Related:

Cisco Firepower Threat Defense Software SSL/TLS URL Category Bypass Vulnerability

Cisco Leave a comment

A vulnerability in the Transport Layer Security version 1.3 (TLS 1.3) policy with URL category functionality for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured TLS 1.3 policy to block traffic for a specific URL.

The vulnerability is due to a logic error with Snort handling of the connection with the TLS 1.3 policy and URL category configuration. An attacker could exploit this vulnerability by sending crafted TLS 1.3 connections to an affected device. A successful exploit could allow the attacker to bypass the TLS 1.3 policy and access URLs that are outside the affected device and normally would be dropped.

There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssl-bypass-O5tGum2n

Security Impact Rating: Medium

CVE: CVE-2020-3285

Related:

  • No Related Posts