cnvd - cnvd-2018-02953

CNVD-2018-02953

Vulnerability from cnvd - Published: 2018-02-08

Title

Cisco Adaptive Security Appliance远程代码执行漏洞

Description

Cisco 3000 Series Industrial Security Appliances（ISR）等都是美国思科（Cisco）公司的安全防火墙设备。Adaptive Security Appliance（ASA）Software是使用在其中的一套防火墙软件。多款Cisco产品中的ASA Software的Secure Sockets Layer (SSL) VPN功能存在远程代码执行漏洞。远程攻击者可利用该漏洞通过向配置有webvpn的界面发送特制的XML数据包造成拒绝服务（重新加载）或执行代码。

Severity

高

Patch Name

Cisco Adaptive Security Appliance远程代码执行漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg35618

Reference

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1 https://nvd.nist.gov/vuln/detail/CVE-2018-0101

Impacted products

Name
['Cisco 3000 Series Industrial Security Appliance (ISA)', 'Cisco ASA 5500 Series Adaptive Security Appliances', 'Cisco ASA 5500-X Series Next-Generation Firewalls', 'Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches', 'Cisco 7600 Series Routers', 'Cisco ASA 1000V Cloud Firewall', 'Cisco Adaptive Security Virtual Appliance (ASAv)', 'Cisco Firepower 2100 Series Security Appliance', 'Cisco Firepower 4110 Security Appliance', 'Cisco Firepower 9300 ASA Security Module', 'Cisco Firepower Threat Defense Software (FTD)']

Name

['Cisco 3000 Series Industrial Security Appliance (ISA)', 'Cisco ASA 5500 Series Adaptive Security Appliances', 'Cisco ASA 5500-X Series Next-Generation Firewalls', 'Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches', 'Cisco 7600 Series Routers', 'Cisco ASA 1000V Cloud Firewall', 'Cisco Adaptive Security Virtual Appliance (ASAv)', 'Cisco Firepower 2100 Series Security Appliance', 'Cisco Firepower 4110 Security Appliance', 'Cisco Firepower 9300 ASA Security Module', 'Cisco Firepower Threat Defense Software (FTD)']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-0101"
    }
  },
  "description": "Cisco 3000 Series Industrial Security Appliances\uff08ISR\uff09\u7b49\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u5b89\u5168\u9632\u706b\u5899\u8bbe\u5907\u3002Adaptive Security Appliance\uff08ASA\uff09Software\u662f\u4f7f\u7528\u5728\u5176\u4e2d\u7684\u4e00\u5957\u9632\u706b\u5899\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u6b3eCisco\u4ea7\u54c1\u4e2d\u7684ASA Software\u7684Secure Sockets Layer (SSL) VPN\u529f\u80fd\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u5411\u914d\u7f6e\u6709webvpn\u7684\u754c\u9762\u53d1\u9001\u7279\u5236\u7684XML\u6570\u636e\u5305\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u91cd\u65b0\u52a0\u8f7d\uff09\u6216\u6267\u884c\u4ee3\u7801\u3002",
  "discovererName": "Cedric Halbronn from the NCC Group",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg35618",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-02953",
  "openTime": "2018-02-08",
  "patchDescription": "Cisco 3000 Series Industrial Security Appliances\uff08ISR\uff09\u7b49\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u5b89\u5168\u9632\u706b\u5899\u8bbe\u5907\u3002Adaptive Security Appliance\uff08ASA\uff09Software\u662f\u4f7f\u7528\u5728\u5176\u4e2d\u7684\u4e00\u5957\u9632\u706b\u5899\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u6b3eCisco\u4ea7\u54c1\u4e2d\u7684ASA Software\u7684Secure Sockets Layer (SSL) VPN\u529f\u80fd\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u5411\u914d\u7f6e\u6709webvpn\u7684\u754c\u9762\u53d1\u9001\u7279\u5236\u7684XML\u6570\u636e\u5305\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u91cd\u65b0\u52a0\u8f7d\uff09\u6216\u6267\u884c\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Adaptive Security Appliance\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Cisco 3000 Series Industrial Security Appliance (ISA)",
      "Cisco ASA 5500 Series Adaptive Security Appliances",
      "Cisco ASA 5500-X Series Next-Generation Firewalls",
      "Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches",
      "Cisco 7600 Series Routers",
      "Cisco ASA 1000V Cloud Firewall",
      "Cisco Adaptive Security Virtual Appliance (ASAv)",
      "Cisco Firepower 2100 Series Security Appliance",
      "Cisco Firepower 4110 Security Appliance",
      "Cisco Firepower 9300 ASA Security Module",
      "Cisco Firepower Threat Defense Software (FTD)"
    ]
  },
  "referenceLink": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-0101",
  "serverity": "\u9ad8",
  "submitTime": "2018-01-31",
  "title": "Cisco Adaptive Security Appliance\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2018-0101 (GCVE-0-2018-0101)

Vulnerability from cvelistv5 – Published: 2018-01-29 20:00 – Updated: 2024-12-02 21:25

Summary

A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618.

Severity ?

No CVSS data available.

CWE

CWE-415

Assigner

cisco

References

URL

Tags

	https://icanthackit.wordpress.com/2018/01/30/thou…	x_refsource_MISC
	http://www.securityfocus.com/bid/102845	vdb-entryx_refsource_BID
	https://tools.cisco.com/security/center/content/C…	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1040292	vdb-entryx_refsource_SECTRACK
	https://www.exploit-db.com/exploits/43986/	exploitx_refsource_EXPLOIT-DB
	https://pastebin.com/YrBcG2Ln	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Cisco Adaptive Security Appliance	Affected: Cisco Adaptive Security Appliance

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:14:16.591Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://icanthackit.wordpress.com/2018/01/30/thoughts-on-the-handling-cve-2018-0101-cisco-bug-cscvg35618/"
          },
          {
            "name": "102845",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/102845"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1"
          },
          {
            "name": "1040292",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1040292"
          },
          {
            "name": "43986",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/43986/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pastebin.com/YrBcG2Ln"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-0101",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-02T19:24:15.000038Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-02T21:25:00.235Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Adaptive Security Appliance",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco Adaptive Security Appliance"
            }
          ]
        }
      ],
      "datePublic": "2018-01-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "CWE-415",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-09T10:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://icanthackit.wordpress.com/2018/01/30/thoughts-on-the-handling-cve-2018-0101-cisco-bug-cscvg35618/"
        },
        {
          "name": "102845",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/102845"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1"
        },
        {
          "name": "1040292",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1040292"
        },
        {
          "name": "43986",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/43986/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pastebin.com/YrBcG2Ln"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2018-0101",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Adaptive Security Appliance",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Cisco Adaptive Security Appliance"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-415"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://icanthackit.wordpress.com/2018/01/30/thoughts-on-the-handling-cve-2018-0101-cisco-bug-cscvg35618/",
              "refsource": "MISC",
              "url": "https://icanthackit.wordpress.com/2018/01/30/thoughts-on-the-handling-cve-2018-0101-cisco-bug-cscvg35618/"
            },
            {
              "name": "102845",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/102845"
            },
            {
              "name": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1",
              "refsource": "CONFIRM",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1"
            },
            {
              "name": "1040292",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1040292"
            },
            {
              "name": "43986",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/43986/"
            },
            {
              "name": "https://pastebin.com/YrBcG2Ln",
              "refsource": "MISC",
              "url": "https://pastebin.com/YrBcG2Ln"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2018-0101",
    "datePublished": "2018-01-29T20:00:00",
    "dateReserved": "2017-11-27T00:00:00",
    "dateUpdated": "2024-12-02T21:25:00.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-02953

CVE-2018-0101 (GCVE-0-2018-0101)

Tags

Sightings

Nomenclature