Cisco Releases Security Updates

Cisco has released updates to address multiple vulnerabilities in its Adaptive Security Appliance ASA software. Exploitation of these vulnerabilities could allow a remote attacker to cause a denial-of-service condition. US-CERT encourages users and administrators to review the Cisco security...

Design/Logic Flaw

The Unicast Reverse Path Forwarding uRPF implementation in Cisco Adaptive Security Appliance ASA Software 9.31.50, 9.32.100, 9.33, and 9.41 mishandles cases where an IP address belongs to an internal interface but is also in the ASA routing table, which allows remote attackers to bypass uRPF...

CVE-2015-4458

CVE-2015-4458 affects Cisco ASA and related products where the Cavium cryptographic-module TLS code fails to verify the MAC field. The root cause is an error in the Cavium firmware that allows a remote attacker to modify TLS packets without detection, enabling MITM content spoofing. Connected sou...

PT-2015-1639 · Cisco +1 · Cisco Asa +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software version 9.15.21 Description: The issue is related to the TLS implementation in the Cavium cryptographic-module firmware, which does not verify the MAC field. This allows man-in-the-middle attacke...

CVE-2015-4239

CVE-2015-4239 affects Cisco ASA software (ASA 9.3(2.243) and 100.13(0.21)). The vulnerability arises from improper handling of OSPFv2 packets in the ASA’s OSPFv2 code, allowing an unauthenticated, adjacent attacker on the local network to cause a denial of service and a device reload. Exploitatio...

CVE-2015-4238

The SNMP implementation in Cisco Adaptive Security Appliance ASA Software 8.47 and 8.61.2 allows remote authenticated users to cause a denial of service device reload by sending many SNMP requests during a time of high network traffic, aka Bug ID CSCul02601...

Design/Logic Flaw

The SNMP implementation in Cisco Adaptive Security Appliance ASA Software 8.47 and 8.61.2 allows remote authenticated users to cause a denial of service device reload by sending many SNMP requests during a time of high network traffic, aka Bug ID CSCul02601...

Cisco Adaptive Security Appliance SNMP Denial of Service Vulnerability

A vulnerability in the Simple Network Management Protocol SNMP code of Cisco Adaptive Security Appliance ASA Software could allow an authenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper handling of SNMP packets. An attacker could exploit th...

CVE-2015-0760

The IKEv1 implementation in Cisco ASA Software 7.x, 8.0.x, 8.1.x, and 8.2.x before 8.2.2.13 allows remote authenticated users to bypass XAUTH authentication via crafted IKEv1 packets, aka Bug ID CSCus47259...

Authentication flaw

The IKEv1 implementation in Cisco ASA Software 7.x, 8.0.x, 8.1.x, and 8.2.x before 8.2.2.13 allows remote authenticated users to bypass XAUTH authentication via crafted IKEv1 packets, aka Bug ID CSCus47259...

CVE-2015-0760

Cisco ASA Software versions 7.x, 8.0.x, 8.1.x, and 8.2.x before 8.2.2.13 contain a vulnerability in the IKEv1 code that can be exploited by an authenticated, remote attacker to bypass XAUTH authentication via crafted IKEv1 packets. The issue (Bug CSCus47259) allows bypass of Extended Authenticati...

Design/Logic Flaw

The DNS implementation in Cisco Adaptive Security Appliance ASA Software 7.2 before 7.25.16, 8.2 before 8.25.57, 8.3 before 8.32.44, 8.4 before 8.47.28, 8.5 before 8.51.24, 8.6 before 8.61.17, 8.7 before 8.71.16, 9.0 before 9.04.33, 9.1 before 9.16.1, 9.2 before 9.23.4, and 9.3 before 9.33 allows...

CVE-2015-0675

The failover ipsec implementation in Cisco Adaptive Security Appliance ASA Software 9.1 before 9.16, 9.2 before 9.23.3, and 9.3 before 9.33 does not properly validate failover communication messages, which allows remote attackers to reconfigure an ASA device, and consequently obtain administrativ...

CVE-2014-8023

Cisco Adaptive Security Appliance ASA Software 9.2.3 and earlier, when challenge-response authentication is used, does not properly select tunnel groups, which allows remote authenticated users to bypass intended resource-access restrictions via a crafted tunnel-group parameter, aka Bug ID...

Cisco Adaptive Security Appliance (ASA) Software Denial of Service Vulnerability (CNVD-2015-00992)

The Cisco Adaptive Security Appliance is an adaptive security appliance that provides modules for security and VPN services. A denial-of-service vulnerability exists in the Cisco Adaptive Security Appliance ASA Software, which can be exploited by an attacker to cause an affected appliance to cras...

Design/Logic Flaw

The Proxy Bypass Content Rewriter feature in the WebVPN subsystem in Cisco Adaptive Security Appliance ASA Software 9.1.2 and earlier allows remote authenticated users to cause a denial of service device crash or error-recovery event via an HTTP request that triggers a rewrite, aka Bug ID...

CVE-2013-5557

The Proxy Bypass Content Rewriter feature in the WebVPN subsystem in Cisco Adaptive Security Appliance ASA Software 9.1.2 and earlier allows remote authenticated users to cause a denial of service device crash or error-recovery event via an HTTP request that triggers a rewrite, aka Bug ID...

Cisco ASA Software DHCPv6 Relay Denial of Service Vulnerability

A vulnerability in the DHCPv6 relay feature of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to insufficient validation of DHCPv6 packets. Cisco ASA Software is affected by this...

Design/Logic Flaw

The syslog-management subsystem in Cisco Adaptive Security Appliance ASA Software allows remote attackers to obtain an administrator password by waiting for an administrator to copy a file, and then 1 sniffing the network for a syslog message or 2 reading a syslog message in a file on a syslog...

CVE-2014-3410

The syslog-management subsystem in Cisco Adaptive Security Appliance ASA Software allows remote attackers to obtain an administrator password by waiting for an administrator to copy a file, and then 1 sniffing the network for a syslog message or 2 reading a syslog message in a file on a syslog...