cisco-sa-20170405-cfpw

A vulnerability in the detection engine reassembly of Secure Sockets Layer (SSL) packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition because the Snort process consumes a high level of CPU resources. The vulnerability is due to improper handling of an SSL packet stream. An attacker could exploit this vulnerability by sending a crafted SSL packet stream to the detection engine on the targeted device. An exploit could allow the attacker to cause a DoS condition because the Snort process consumes a high level of CPU resources. The device must be manually reloaded to recover from this condition. There are no workarounds that address this vulnerability.