^{CVE-2023-20177:}Cisco Firepower Threat Defense (FTD) Software contains a vulnerability in the SSL file policy implementation that allows remote attackers to cause the Snort 3 detection engine to unexpectedly restart.

A vulnerability exists in Cisco Firepower Threat Defense (FTD) Software's SSL file policy implementation when SSL/TLS connections are configured with a URL Category and the Snort 3 detection engine is in use. Due to a logic error in how the Snort 3 engine inspects these connections, an unauthenticated remote attacker can send crafted SSL/TLS traffic through an affected device under specific time-based constraints, causing the detection engine to unexpectedly restart. This can result in either a security bypass or denial of service condition depending on the device configuration. While the Snort 3 detection engine will automatically restart without manual intervention, the temporary disruption can impact security monitoring and enforcement capabilities.

Overview

This vulnerability (CVE-2023-20177) affects Cisco Firepower Threat Defense Software when using the Snort 3 detection engine with either:

• URL Category configured on the SSL file policy, or
• URL Category configured on an access control policy with TLS server identity discovery enabled

The vulnerability is triggered by a logic error in the inspection process of SSL/TLS connections under these specific configurations. When exploited, the Snort 3 detection engine unexpectedly restarts, which can lead to two possible security impacts:

1. Security bypass: Traffic may pass uninspected during the restart period
2. Denial of service: Network traffic inspection may be temporarily unavailable

The vulnerability requires no authentication and can be exploited remotely by sending specially crafted SSL/TLS connections through the affected device.

Remediation

To address this vulnerability, organizations should:

1. Update to a patched version of Cisco Firepower Threat Defense Software as recommended in the Cisco Security Advisory (cisco-sa-sa-ftd-snort3-urldos-OccFQTeX).

2. If immediate patching is not possible, consider these mitigations:

   • Disable URL Category configurations in SSL file policies
   • Disable URL Category configurations in access control policies when TLS server identity discovery is enabled
   • Implement network segmentation to limit exposure of affected devices
   • Monitor for unexpected Snort 3 detection engine restarts which may indicate exploitation attempts

3. After patching, verify proper operation of the Snort 3 detection engine and SSL/TLS inspection capabilities.

References

1. Cisco Security Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sa-ftd-snort3-urldos-OccFQTeX
2. MITRE CVE Entry: CVE-2023-20177
3. Cisco Firepower Threat Defense Documentation: https://www.cisco.com/c/en/us/products/security/firepower-ngfw/index.html