Cisco Cisco Firepower Management Center 2000

Resolved an arbitrary injection vulnerability allowing unauthenticated, remote attackers to execute 
commands via Bash. This addresses CVE-2014-6271 and CVE-2014-7169. For more information, 
refer to the Cisco Security Advisory page at 

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash

. 

(144863, 144942, 144949)

Because you can update your appliances from Version 5.3.1 to Version 5.3.1.1, this update also includes 
the changes in all updates from Version 5.3.1. Previously resolved issues are listed by version.

Resolved an issue where, in some cases, the intrusion event packet view displayed a rule message 
that did not match the rule that generated the event. (138208)

Resolved an issue where you could not import an intrusion rule that referenced a custom variable. 
(138211)

Resolved an issue where enabling telnet on a Cisco IOS Null Route remediation module and 
configuring the username for the Cisco IOS instance to enable by default on the Cisco IOS router 
caused Cisco IOS Null Route remediations to fail on the Defense Center. (139506)

Resolved an issue where the system did not prevent you from creating a network variable with an 
excluded network value that excluded all (any) networks. (139510)

The following known issues are reported in Version 5.3.1.1:

In some cases, applying changes to your access control policy, intrusion policy, network discovery 
policy, or device configuration, or installing an intrusion rule update or update of the vulnerability 
database (VDB) causes the system to experience a disruption in traffic that uses Link Aggregation 
Control Protocol (LACP) in fast mode. As a workaround, configure LACP links in slow mode. 
(112070)

Configuring a proxy server to authenticate with a Message Digest 5 (MD5) password encryption for 
malware cloud lookups is not supported. (135279)

The system requires additional time to reboot appliances or ASA FirePOWER devices running 
Version 5.3 or later due to a database check. If errors are found during the database check, the reboot 
requires additional time to repair the database. (135564, 136439)

In some cases, if you create a system policy on the primary Defense Center in a high availability 
configuration and then manually synchronize the secondary Defense Center, the system generates 
an 

ERROR 500 Internal Server Error

 message. (139685)

If you use Internet Explorer 11 to add a report parameter to the report section title bar while creating 
a new report template (

), no report fields are added to the 

template. As a workaround, install and use Internet Explorer 10. (142950)

If you register a 3D9900 device running version Version 5.3.0.2 or earlier to a Defense Center 
running Version 5.3.1.x or later, passive interfaces on the 3D9900 that are not in a security zone do 
not generate intrusion events. (144171)

The following known issues were reported in previous releases:

If the system generates intrusion events with a 

 of 

0

, the Top 10 Destination 

Ports section of the Intrusion Event Statistics page (

) 

omits port numbers from the display. (125581)