Multiple Vulnerabilities in Cisco ASA Software

Cisco Adaptive Security Appliance (ASA) Software is affected by the following vulnerabilities:

Cisco ASA Failover Command Injection Vulnerability
Cisco ASA DNS Memory Exhaustion Vulnerability
Cisco ASA VPN XML Parser Denial of Service Vulnerability 

Successful exploitation of the Cisco ASA Failover Command Injection Vulnerability would
allow an attacker to submit failover commands to the failover units, which may result in an attacker taking full control of the systems.

Successful exploitation of the Cisco ASA DNS Memory Exhaustion Vulnerability may result in
system instability and dropped traffic.

Successful exploitation of the
Cisco ASA VPN XML Parser Denial of Service Vulnerability may result in a crash of the WebVPN
process, which may lead to the reset of all SSL VPN connections, system
instability, and a reload of the affected system.

Cisco has released software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are
available for the Cisco ASA Failover Command Injection Vulnerability and
Cisco ASA DNS Memory Exhaustion Vulnerability. This advisory is available at the following link:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa[“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa”]

Note: The resolution of the vulnerability in the Cisco Security Advisory Cisco
ASA FirePOWER Services and Cisco ASA CX Crafted Packets Denial of
Service Vulnerability, cisco-sa-20150408-cxfp, released on the 8th of April may require an upgrade of the Cisco
ASA Software release. Cisco ASA customers should review cisco-sa-20150408-cxfp
before deciding which Cisco ASA Software release to upgrade to.

The Cisco Security Advisory Cisco ASA FirePOWER Services and Cisco ASA
CX Crafted Packets Denial of Service Vulnerability is available at the
following link:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-cxfp[“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-cxfp”]