Lucene search

CiscoCVE-2019-15992

HistorySep 23, 2020 - 1:15 a.m.

CVE-2019-15992

2020-09-2301:15:13

CWE-119

CWE-787

cisco

web.nvd.nist.gov

cve-2019-15992

vulnerability

lua interpreter

cisco asa

ftd software

code execution

root privileges

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.002

Percentile

54.1%

JSON

A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating system of an affected device. The vulnerability is due to insufficient restrictions on the allowed Lua function calls within the context of user-supplied Lua scripts. A successful exploit could allow the attacker to trigger a heap overflow condition and execute arbitrary code with root privileges on the underlying Linux operating system of an affected device.

Affected configurations

Nvd

Node

ciscoadaptive_security_applianceRange<9.6.4.36

ciscoadaptive_security_appliance_softwareRange9.7–9.8.4.15

ciscoadaptive_security_appliance_softwareRange9.9–9.9.2.61

ciscoadaptive_security_appliance_softwareRange9.10–9.10.1.32

ciscoadaptive_security_appliance_softwareRange9.12–9.12.3

ciscoadaptive_security_appliance_softwareRange9.13–9.13.1.4

ciscoadaptive_security_appliance_softwareRange9.14–9.14.2.7

ciscoadaptive_security_appliance_softwareRange9.15–9.15.1.4

Node

ciscofirepower_management_centerRange<6.2.3.16

ciscofirepower_management_centerRange6.3.0–6.3.0.6

ciscofirepower_management_centerRange6.4.0–6.4.0.7

ciscofirepower_management_centerRange6.5.0–6.5.0.2

Node

ciscofirepower_threat_defenseMatch-

VendorProductVersionCPE
ciscoadaptive_security_appliance*cpe:2.3:a:cisco:adaptive_security_appliance:*:*:*:*:*:*:*:*
ciscoadaptive_security_appliance_software*cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
ciscofirepower_management_center*cpe:2.3:a:cisco:firepower_management_center:*:*:*:*:*:*:*:*
ciscofirepower_threat_defense-cpe:2.3:a:cisco:firepower_threat_defense:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	adaptive_security_appliance	*	cpe:2.3:a:cisco:adaptive_security_appliance::::::::
cisco	adaptive_security_appliance_software	*	cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::
cisco	firepower_management_center	*	cpe:2.3:a:cisco:firepower_management_center::::::::
cisco	firepower_threat_defense	-	cpe:2.3:a:cisco:firepower_threat_defense:-:::::::*

CNA Affected

[
  {
    "product": "Cisco Adaptive Security Appliance (ASA) Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191112-asa-ftd-lua-rce

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.002

Percentile

54.1%

JSON

Related for CVE-2019-15992