Heap-based buffer overflow in Cisco Firewall Threat Defense (FTD) - CVE-2022-20946

Vulnerability identifier: #VU69206

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-20946

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the generic routing encapsulation (GRE) tunnel decapsulation feature. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and cause a denial of service condition on the target system.

Cisco Firewall Threat Defense (FTD)

Install updates from vendor's website.

Cisco Firewall Threat Defense (FTD) - addressed in versions 006.006(007), 007.000(004), 007.002(001), 009.012(004.042), 9.12.4.48, 9.12.4.50, 9.12.4.52, 009.014(004.008), 9.14.4.13, 9.14.4.14, 009.016(003.015), 9.16.3.19, 9.16.3.23, 009.016(003.099), 9.16.4, 009.016(004), 009.017(001.010), 9.17.1.13, 9.17.1.15, 009.018(000.108), 9.18.1, 009.018(001), 009.018(001.099), 009.018(002), 9.18.2, 9.18.2.5, 009.019(000.099), 099.012(004.055), 099.014(004.023), 099.016(004.023), 099.017(002.135), 099.017(028.079), 099.018(002.007), 099.018(030.062), 099.019(001.080), 099.019(021.020), 099.019(022.024), 099.019(023.018), 099.019(030.002)

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-gre-dos-hmedHQPM

• Heap-based buffer overflow in Cisco Firepower Threat Defense Software