Description Preview
CVE-2020-3285 affects Cisco Firepower Threat Defense (FTD) Software and involves a logic error in how Snort handles TLS 1.3 connections with URL category configurations. This vulnerability allows unauthenticated remote attackers to bypass configured TLS 1.3 policies that are intended to block traffic for specific URLs. By sending specially crafted TLS 1.3 connections to an affected device, attackers can circumvent security controls and access URLs that would normally be blocked by the system.
Overview
This vulnerability exists in the Transport Layer Security version 1.3 (TLS 1.3) policy implementation when used with URL category functionality in Cisco FTD Software. The root cause is a logic error in how the Snort engine processes connections that are subject to both TLS 1.3 policies and URL category filtering. When exploited, the vulnerability allows attackers to establish connections to URLs that should be blocked according to the configured security policy. This effectively renders URL category-based filtering ineffective for TLS 1.3 traffic, potentially allowing users to access prohibited websites or services despite security controls being in place.
Remediation
Organizations using Cisco Firepower Threat Defense Software should:
- Update to a fixed software version as recommended in the Cisco Security Advisory.
- If immediate patching is not possible, consider implementing additional network security controls to restrict unauthorized outbound connections.
- Monitor network traffic logs for suspicious TLS 1.3 connections that may indicate exploitation attempts.
- Review and validate URL filtering policies to ensure they align with organizational security requirements.
- Consider implementing additional layers of security controls to compensate for this vulnerability until patching is complete.
References
- Cisco Security Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssl-bypass-O5tGum2n
- Title: "Cisco Firepower Threat Defense Software SSL/TLS URL Category Bypass Vulnerability"
- Publication Date: May 6, 2020
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
