Vulnerabilities > CVE-2020-3253 - Unspecified vulnerability in Cisco Firepower Threat Defense

CVSS 6.7 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

cisco

nessus

NVD

Published: 2020-05-06

Updated: 2024-11-21

Summary

A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. The vulnerability is due to improper configuration of the support tunnel feature. An attacker could exploit this vulnerability by enabling the support tunnel, setting a key, and deriving the tunnel password. A successful exploit could allow the attacker to run any system command with root access on an affected device.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco Firepower Threat Defense - Cisco Firepower Threat Defense 5.3.0 Cisco Firepower Threat Defense 5.4.0 Cisco Firepower Threat Defense 6.0 Cisco Firepower Threat Defense 6.0.0 Cisco Firepower Threat Defense 6.0.0.1 Cisco Firepower Threat Defense 6.0.1 Cisco Firepower Threat Defense 6.0.1.1 Cisco Firepower Threat Defense 6.0.1.2 Cisco Firepower Threat Defense 6.0.1.3 Cisco Firepower Threat Defense 6.0.1.4 Cisco Firepower Threat Defense 6.1.0 Cisco Firepower Threat Defense 6.1.0.1 Cisco Firepower Threat Defense 6.1.0.2 Cisco Firepower Threat Defense 6.1.0.3 Cisco Firepower Threat Defense 6.1.0.4 Cisco Firepower Threat Defense 6.1.0.5 Cisco Firepower Threat Defense 6.1.0.6 Cisco Firepower Threat Defense 6.1.0.7 Cisco Firepower Threat Defense 6.2.0 Cisco Firepower Threat Defense 6.2.0.1 Cisco Firepower Threat Defense 6.2.0.2 Cisco Firepower Threat Defense 6.2.0.3 Cisco Firepower Threat Defense 6.2.0.4 Cisco Firepower Threat Defense 6.2.0.5 Cisco Firepower Threat Defense 6.2.0.6 Cisco Firepower Threat Defense 6.2.1 Cisco Firepower Threat Defense 6.2.2 Cisco Firepower Threat Defense 6.2.2.1 Cisco Firepower Threat Defense 6.2.2.2 Cisco Firepower Threat Defense 6.2.2.3 Cisco Firepower Threat Defense 6.2.2.4 Cisco Firepower Threat Defense 6.2.2.5 Cisco Firepower Threat Defense 6.2.3 Cisco Firepower Threat Defense 6.2.3.0 Cisco Firepower Threat Defense 6.2.3.1 Cisco Firepower Threat Defense 6.2.3.2 Cisco Firepower Threat Defense 6.2.3.3 Cisco Firepower Threat Defense 6.2.3.4 Cisco Firepower Threat Defense 6.2.3.5 Cisco Firepower Threat Defense 6.2.3.6 Cisco Firepower Threat Defense 6.2.3.7 Cisco Firepower Threat Defense 6.2.3.8 Cisco Firepower Threat Defense 6.2.3.9 Cisco Firepower Threat Defense 6.2.3.10 Cisco Firepower Threat Defense 6.2.3.11 Cisco Firepower Threat Defense 6.2.3.12 Cisco Firepower Threat Defense 6.2.3.13 Cisco Firepower Threat Defense 6.2.3.14 Cisco Firepower Threat Defense 6.2.3.15 Cisco Firepower Threat Defense 6.2.3.16 Cisco Firepower Threat Defense 6.2.3.17 Cisco Firepower Threat Defense 6.2.3.18 Cisco Firepower Threat Defense 6.3.0 Cisco Firepower Threat Defense 6.3.0.1 Cisco Firepower Threat Defense 6.3.0.2 Cisco Firepower Threat Defense 6.3.0.3 Cisco Firepower Threat Defense 6.3.0.4 Cisco Firepower Threat Defense 6.3.0.5 Cisco Firepower Threat Defense 6.3.0.6 Cisco Firepower Threat Defense 6.4.0 Cisco Firepower Threat Defense 6.4.0.1 Cisco Firepower Threat Defense 6.4.0.2 Cisco Firepower Threat Defense 6.4.0.3 Cisco Firepower Threat Defense 6.4.0.4 Cisco Firepower Threat Defense 6.4.0.5 Cisco Firepower Threat Defense 6.4.0.6 Cisco Firepower Threat Defense 6.4.0.7 Cisco Firepower Threat Defense 6.4.0.8 Cisco Firepower Threat Defense 6.4.0.9 Cisco Firepower Threat Defense 6.4.0.10 Cisco Firepower Threat Defense 6.4.0.11 Cisco Firepower Threat Defense 6.4.0.12 Cisco Firepower Threat Defense 6.4.0.13 Cisco Firepower Threat Defense 6.4.0.14 Cisco Firepower Threat Defense 6.4.0.15 Cisco Firepower Threat Defense 6.4.0.16 Cisco Firepower Threat Defense 6.4.0.17 Cisco Firepower Threat Defense 6.4.1	79

Nessus

NASL family	CISCO
NASL id	CISCO-SA-FTD-SHELL-9RHJF68K.NASL
description	According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a shell access vulnerability in the support tunnel feature due to improper configuration of that feature. An authenticated, local attacker can exploit this, by enabling the support tunnel, setting a key, and deriving the tunnel password, to allow the attacker to run any system command with root access. Note that Nessus has not attempted to exploit this issue but has instead relied only on the application
last seen	2020-05-22
modified	2020-05-15
plugin id	136669
published	2020-05-15
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/136669
title	Cisco Firepower Threat Defense Software Shell Access (cisco-sa-ftd-shell-9rhJF68K)
code	#TRUSTED 5659e0b059fa57d0a19b6314aba78bed38201a66eb715f83b4be0003b7aae6848eeef789c8ea73b0835b7da358568f7b890245342f3eb5dd5a0b88ff2e033029d4ff66016a563c7fc7e44e0888aeb7b291bba069860d7f30edaee8af9f9a6f9fb15bee32ebcf1577e45ebf247c5c176c54944fedb9066b2118edc6992d79655db036b4ce7716d4d734d38e5a8f899bc7fb5ede450ba9854ee51f8f66e63b35437beb4306c9077e4d3b038b600b026353de80d2ca567956bd82ffd59c21db8e7cd759f6dd743cdb2231a6ffe49c4864caf0f87e2c4c778d14c41f44f80d153b5d1a66ec1e08a644acea88b049b5ac601d3e6eba0a9cc56c39186f70953315efeef3eaa26e6c5d530f5fb5804976c0716833e7967300bc1b4e4761c2780e9a75c39c1ada43a6802d0403ffbf964b8d1cb33374856b45e318c7cb45e10d4ed03af8b7d7314d00bb46b14ccefd8d485c2371b19a2044615ee643b834c88fa8e06fbee9a187973a8c5f062675d1fc23eb12f6b9dfcc86fe805b0a6f2603a5c4f9c7bb2756b2fe5baa15a41114deb5554c246fbbc360de0edea37779b6eb0204a13978dc37a0df99fc4be83a5f7b59a25f2dbca89c0a540b4a704f0fcbcbb0e6b0859bc3072ddbb71f49a97cc5d05bda804eae218b8777c1dddbf65d7f94485c34e75ac91110343082adcac81ed1afeef7c80cf2a1bf886f318f51bd82de19886ed5c3 # # (C) Tenable Network Security, Inc. # include('compat.inc'); if (description) { script_id(136669); script_version("1.6"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/21"); script_cve_id("CVE-2020-3253"); script_xref(name:"CISCO-BUG-ID", value:"CSCvp16933"); script_xref(name:"CISCO-SA", value:"cisco-sa-ftd-shell-9rhJF68K"); script_xref(name:"IAVA", value:"2020-A-0205"); script_xref(name:"IAVA", value:"2020-A-0206"); script_name(english:"Cisco Firepower Threat Defense Software Shell Access (cisco-sa-ftd-shell-9rhJF68K)"); script_set_attribute(attribute:"synopsis", value: "The remote device is missing a vendor-supplied security patch."); script_set_attribute(attribute:"description", value: "According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a shell access vulnerability in the support tunnel feature due to improper configuration of that feature. An authenticated, local attacker can exploit this, by enabling the support tunnel, setting a key, and deriving the tunnel password, to allow the attacker to run any system command with root access. Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number."); # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-shell-9rhJF68K script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?979c9bac"); script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvp16933"); script_set_attribute(attribute:"solution", value: "Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvp16933"); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-3253"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_cwe_id(284); script_set_attribute(attribute:"vuln_publication_date", value:"2020/05/06"); script_set_attribute(attribute:"patch_publication_date", value:"2020/05/06"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/15"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:firepower_threat_defense"); script_set_attribute(attribute:"stig_severity", value:"I"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"CISCO"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl", "cisco_enumerate_firepower.nbin", "cisco_asa_firepower_version.nasl"); script_require_keys("installed_sw/Cisco Firepower Threat Defense"); exit(0); } include('cisco_workarounds.inc'); include('ccf.inc'); product_info = cisco::get_product_info(name:'Cisco Firepower Threat Defense'); vuln_ranges = [ {'min_ver' : '0.0', 'fix_ver': '6.5.0'} ]; workarounds = make_list(CISCO_WORKAROUNDS['no_workaround']); workaround_params = make_list(); reporting = make_array( 'port' , 0, 'severity' , SECURITY_HOLE, 'version' , product_info['version'], 'bug_id' , 'CSCvp16933' ); cisco::check_and_report( product_info:product_info, workarounds:workarounds, workaround_params:workaround_params, reporting:reporting, vuln_ranges:vuln_ranges );

Summary

Vulnerable Configurations

Nessus

References