CVE-2015-6357
published 2015-11-18CVE-2015-6357: The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.sourcefire.com SSL…
PriorityP336medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
2.63%
83.8th percentile
The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.sourcefire.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide an invalid package, and consequently execute arbitrary code, via a crafted certificate, aka Bug ID CSCuw06444.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | firesight_management_center | — | — |
| cisco | firesight_system_software | — | — |
| cisco | firesight_system_software | — | — |
| cisco | firesight_system_software | — | — |
| cisco | firesight_system_software | — | — |
| cisco | firesight_system_software | — | — |
| cisco | firesight_system_software | — | — |
| cisco | firesight_system_software | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_cisco5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco FireSIGHT Management Center Certificate Validation Vulnerability
vendor_cisco·2015-11-16·CVSS 5.1
CVE-2015-6357 [MEDIUM] CWE-20 Cisco FireSIGHT Management Center Certificate Validation Vulnerability
Cisco FireSIGHT Management Center Certificate Validation Vulnerability
A vulnerability in the rule update functionality of Cisco FireSIGHT Management Center (MC) could allow an unauthenticated, remote attacker to manipulate the content of the rule update packages and execute arbitrary code on the system.
The vulnerability is due to lack of certificate validation during the HTTPS connection toward support.sourcefire.com to download the rule update package. An attacker could exploit this vulnerability by performing a man-in-the-middle attack (such as DNS hijacking) to enable manipulation of the rule update package content. An exploit could allow the attacker to execute arbitrary code on the system with the privileges of the web server.
Cisco has not released software updates that address
Cisco
Cisco FireSIGHT Management Center Certificate Validation Vulnerability
vendor_cisco
CVE-2015-6357 Cisco FireSIGHT Management Center Certificate Validation Vulnerability
CVE-2015-6357: Cisco FireSIGHT Management Center Certificate Validation Vulnerability
A vulnerability in the rule update functionality of Cisco FireSIGHT Management Center (MC) could allow an unauthenticated, remote attacker to manipulate the content of the rule update packages and execute arbitrary code on the system. The vulnerability is due to lack of certificate validation during the HTTPS connection toward support.sourcefire.com to download the rule update package. An attacker could exploit this vulnerability by performing a man-in-the-middle attack (such as DNS hijacking) to enable manipulation of the rule update package content. An exploit could allow the attacker to execute arbitrary code on the system with the privileges of the web server. Cisco has not released software updates t
GHSA
GHSA-8j79-x4hx-j6c3: The rule-update feature in Cisco FireSIGHT Management Center (MC) 5
ghsa_unreviewed·2022-05-14
CVE-2015-6357 [MEDIUM] CWE-20 GHSA-8j79-x4hx-j6c3: The rule-update feature in Cisco FireSIGHT Management Center (MC) 5
The rule-update feature in Cisco FireSIGHT Management Center (MC) 5.2 through 5.4.0.1 does not verify the X.509 certificate of the support.sourcefire.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide an invalid package, and consequently execute arbitrary code, via a crafted certificate, aka Bug ID CSCuw06444.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/134390/Cisco-FireSIGHT-Management-Center-Certificate-Validation.htmlhttp://seclists.org/fulldisclosure/2015/Nov/79http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151116-fmchttp://wadofstuff.blogspot.com.au/2015/11/cve-2015-6357-firepwner-exploit-for.htmlhttp://www.securityfocus.com/archive/1/536913/100/0/threadedhttp://www.securitytracker.com/id/1034161http://packetstormsecurity.com/files/134390/Cisco-FireSIGHT-Management-Center-Certificate-Validation.htmlhttp://seclists.org/fulldisclosure/2015/Nov/79http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151116-fmchttp://wadofstuff.blogspot.com.au/2015/11/cve-2015-6357-firepwner-exploit-for.htmlhttp://www.securityfocus.com/archive/1/536913/100/0/threadedhttp://www.securitytracker.com/id/1034161
2015-11-18
Published