topic Query regarding Snort rule/FMC upgrade against Log4j vulnerability in Network Security

Query regarding Snort rule/FMC upgrade against Log4j vulnerability

atsukane — Tue, 14 Dec 2021 09:00:24 GMT

Query regarding Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021

As per the above critical advisory, I was looking at new Intrusion rule in the older FMC that we have (running version 6.1.0.5) and noticed that download of the new rules have been failing due to certificate issue.

“Download updates failed: Peer certificate cannot be authenticated with known CA certificates”

Is it possible to download the specific new rules manually, if so how?

If this is not possible, I’ve found that upgrading the FMC to 6.2.0 fixes the certificate issue affecting download from FMC.

In order to upgrade from 6.1.0.5 to 6.2.0, can I double check that:

Direct upgrade from 6.1.0.5 to 6.2.0 is supported?
Managed ASA5555 FirePOWER module is ver 6.0.1.4 and this is compatible with FMC ver 6.2.0?

We are looking to replace this ASA to FPR2140 which is managed on the newer build FMC so want to spend as little time and effort as possible.

Please advise.

Many thanks,

Re: Query regarding Snort rule/FMC upgrade against Log4j vulnerability

atsukane — Tue, 14 Dec 2021 09:13:22 GMT

Ah, I'm guessing 'Update Intrusion Rules' is the bit I need to understand

Firepower Management Center Configuration Guide, Version 6.4 - System Updates [Cisco Firepower Management Center] - Cisco

Re: Query regarding Snort rule/FMC upgrade against Log4j vulnerability

atsukane — Tue, 14 Dec 2021 13:14:04 GMT

So updating to the latest Intrusion rules has worked and I can see the Log4j drop rules are in the policy.

Re: Query regarding Snort rule/FMC upgrade against Log4j vulnerability

Marvin Rhoads — Tue, 14 Dec 2021 15:21:27 GMT

6.1.0.5 to 6.2.0 is a direct upgrade that is supported:

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/relnotes/Firepower_System_Release_Notes_Version_620/important_update_notes.html#id_38002

FMC 6.2.0 cannot manage an ASA Firepower service module running 6.0.1.4.

https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html#reference_A0CAB7C28A2B440F8F901D316D6684F4

Re: Query regarding Snort rule/FMC upgrade against Log4j vulnerability

Heino Human — Wed, 15 Dec 2021 23:21:19 GMT

hey mate

How do you see the events for those "Log4j" logs?

Re: Query regarding Snort rule/FMC upgrade against Log4j vulnerability

atsukane — Fri, 17 Dec 2021 11:13:30 GMT

Thank you @Marvin Rhoads Not sure how I missed that 6.2.0 is not compatible with 6.0.1.4!

Re: Query regarding Snort rule/FMC upgrade against Log4j vulnerability

atsukane — Fri, 17 Dec 2021 11:16:04 GMT

hi @Heino Human

This might be of your interest:

https://blogs.cisco.com/security/protecting-against-log4j-with-secure-firewall-secure-ips