====================================================================

                                   CERT-Renater

                        Note d'Information No. 2016/VULN296
_____________________________________________________________________

DATE                : 17/08/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco Firepower Management Center,
                Cisco ASA 5500-X Series with FirePOWER Services software.

=====================================================================
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-fmc
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-firepower
____________________________________________________________________

Cisco Firepower Management Center Remote Command Execution Vulnerability

Advisory ID: cisco-sa-20160817-fmc

Revision 1.0

For Public Release: 2016 August 17 16:00  GMT

Summary
=======

+---------------------------------------------------------------------

A vulnerability in the web-based GUI of Cisco Firepower Management
Center and Cisco Adaptive Security Appliance (ASA) 5500-X Series with
FirePOWER Services could allow an authenticated, remote attacker to
perform unauthorized remote command execution on the affected device.

The vulnerability is due to insufficient authorization checking. An
attacker could exploit this vulnerability by sending crafted HTTP
requests to the affected device. Successful exploitation could allow an
authenticated attacker to execute system commands with root-level
privileges.

Cisco has released software updates that address this vulnerability.
Workarounds that address this vulnerability are not available.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-fmc

____________________________________________________________________

Cisco Firepower Management Center Privilege Escalation Vulnerability

Advisory ID: cisco-sa-20160817-firepower

Revision 1.0:

For Public Release: 2016 August 17 16:00 GMT

Summary
=======

A vulnerability in the web-based GUI of Cisco Firepower Management
Center and Cisco Adaptive Security Appliance (ASA) 5500-X Series with
FirePOWER Services could allow an authenticated, remote attacker to
elevate the privileges of user accounts on the affected device.

The vulnerability is due to insufficient input validation. An attacker
could exploit this vulnerability by sending crafted HTTP requests to
the affected device. Successful exploitation could allow an
authenticated attacker to elevate the privileges of user accounts
configured on the device.

Cisco has released software updates that address this vulnerability.
Workarounds that address this vulnerability are not available.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-firepower

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================