CVE-2016-9209

Vulnerability

A vulnerability in TCP processing of Cisco FirePOWER system software (versions including 2.9.7.10) allows an unauthenticated, remote attacker to bypass malware protection. The issue occurs when out-of-order TCP segments (retransmissions outside the current window that have already been acknowledged) are not properly processed before being passed to HTTP inspection. For GZIP-compressed streams, this causes decompression to fail, leading to an incorrect SHA-256 hash calculation and potential malware not being detected [1].

Exploitation

An attacker can exploit this vulnerability by tricking a user into downloading a file containing malware via HTTP from a specially prepared server. The attacker sends out-of-order TCP segments to trigger the GZIP decompression failure, then delivers the malicious file. No authentication or prior access is required; the attack relies on user interaction (clicking a link or visiting a malicious site) [1].

Impact

Successful exploitation allows the attacker to bypass the malware protection provided by the FirePOWER system software. The attacker gains the ability to deliver malware that would normally be blocked, potentially leading to further compromise of the target system. The impact is limited to bypassing detection; no direct code execution or privilege escalation is achieved [1].

Mitigation

No workarounds are available for this vulnerability. The Cisco advisory does not specify a fixed release; users should consult the advisory for the latest information on patches or updates [1].