SB2016100526 - Authentication Bypass in Cisco Firepower Threat Management
Published: October 5, 2016 Updated: October 7, 2016
Security Bulletin ID
SB2016100526
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Authentication Bypass (CVE-ID: CVE-2016-6434)
The vulnerability allows a local authenticated user to bypass authentication and obtain potentially sensitive information.The weakness is caused by using of constant credential by the database. If the authenticated user can access the command-line interface (CLI) for the target system he can get database information from a local shell.
Successful exploitation of the vulnerability lets a local attacker to bypass authentication and disclose important data on the vulnerable system.
Remediation
Install update from vendor's website.