====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN325
_____________________________________________________________________

DATE                : 02/11/2017

HARDWARE PLATFORM(S): Cisco Firepower 4100 Series NGFW,
                      Cisco Firepower 9300 Security Appliance.

OPERATING SYSTEM(S): FX-OS versions 1.1.3, 1.1.4, 2.0.1.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-fpwr
____________________________________________________________________

Cisco Security Advisory: Cisco Firepower 4100 Series NGFW and Firepower
9300 Security Appliance Smart Licensing Command Injection Vulnerability

Advisory ID: cisco-sa-20171101-fpwr

Revision: 1.0

For Public Release: 2017 November 1 16:00 GMT

Last Updated: 2017 November 1 16:00 GMT

CVE ID(s): CVE-2017-12277

CVSS Score v(3): 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary
=======
A vulnerability in the Smart Licensing Manager service of the Cisco
Firepower 4100 Series Next-Generation Firewall (NGFW) and Firepower
9300 Security Appliance could allow an authenticated, remote attacker
to inject arbitrary commands that could be executed with root
privileges.

The vulnerability is due to insufficient input validation of certain
Smart Licensing configuration parameters. An authenticated attacker
could exploit the vulnerability by configuring a malicious URL within
the affected feature. A successful exploit could allow the attacker to
execute arbitrary commands with root privileges.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-fpwr
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-fpwr"]

==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================