Cisco ASA Software Version Information Disclosure Vulnerability

A vulnerability in the SSL VPN code of Cisco ASA Software could allow an
unauthenticated, remote attacker to obtain information about the Cisco
ASA Software version. This information could be used for reconnaissance attacks.

The vulnerability is due to verbose output returned when a specific
URL is submitted to the affected system. An attacker could exploit this
vulnerability by browsing to a specific URL. The SSL VPN feature must be
enabled for a system to be vulnerable.

Cisco has confirmed the vulnerability in a security notice and released software updates.

To exploit this vulnerability, an attacker may need to obtain additional information about the targeted device, such as whether the SSL VPN feature is enabled. This feature must be enabled for the attacker to achieve a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.