Vulnerabilities in Cisco FirePower firewalls allow malware Bypass Detection

Vulnerabilities in Cisco FirePower firewalls allow malware Bypass Detection

Security Vulnerabilities in CISCO FirePower firewall devices allow malware to bypass the detection mechanism.

Cisco is releasing security updates to a critical vulnerability (CVE-2016-1345) that affects FirePower firewall, one of Cisco's latest products. This vulnerability was first discovered by security researchers at Check Point.

According to Cisco's Security Bulletin, attackers can exploit this vulnerability remotely to allow malicious software to bypass detection.

The security consultant stated:

"Vulnerabilities in the malicious file detection and interception functions of Cisco Firepower system software may allow unauthenticated remote attackers to bypass the Malware detection mechanism on the affected system ." <For more information, click here>

This vulnerability is related to improper input verification of HTTP header fields. Attackers can exploit this vulnerability remotely by sending a specially crafted HTTP request to a vulnerable system.
The Security Consultant continued:
"Once the vulnerability is successfully exploited, attackers can bypass the malicious file detection function or block the configured system policy, which may allow malicious software to pass the system without detection ."

Cisco marks the vulnerability level as "high-risk vulnerability", so it promptly released security patches for Cisco Firepower system software 5.4.0.7 and later, 5.4.1.6 and later, and 6.0.1 and later.
Cisco confirms that any of the following Cisco products running Cisco Firepower system software may have security vulnerabilities:
ASA 5500-X Series
AMP for Networks 7000 Series devices
AMPfor Networks 8000 Series devices
FirePOWER 7000 Series devices
FirePOWER 8000 Series devices
Comprehensive defense against FirePOWER threats...
One simple way to detect whether your system is affected by this vulnerability is to check Cisco configurations (Policy> Access Control> malware and files ), if the policy is set to "Block Files, block malware or detect files", the system is vulnerable.

This vulnerability also affects Snort open-source network intrusion detection system 2.9.8.2 and later versions.Official WebsiteDownload updates.