CVE-2015-6357

Name of the Vulnerable Software and Affected Versions Cisco FireSIGHT Management Center versions 5.2 through 5.4.0.1

Description The issue concerns the rule-update feature, which fails to verify the X.509 certificate of the support.sourcefire.com SSL server. This allows man-in-the-middle attackers to spoof the server, provide an invalid package, and execute arbitrary code using a crafted certificate.

Recommendations For Cisco FireSIGHT Management Center versions 5.2 through 5.4.0.1, consider disabling the rule-update feature until a patch is available to prevent potential exploitation. Restrict access to the support.sourcefire.com SSL server to minimize the risk of man-in-the-middle attacks.