FKIE_CVE-2009-4913

Vulnerability from fkie_nvd - Published: 2010-06-29 18:30 - Updated: 2025-04-11 00:51
Severity ?
Summary
The IPv6 implementation on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) exposes IP services on the "far side of the box," which might allow remote attackers to bypass intended access restrictions via IPv6 packets, aka Bug ID CSCso58622.
References
cve@mitre.orghttp://www.cisco.com/en/US/docs/security/asa/asa81/release/notes/asarn812.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://www.cisco.com/en/US/docs/security/asa/asa81/release/notes/asarn812.htmlPatch
Impacted products
Vendor Product Version
cisco asa_5580 *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:asa_5580:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "73E464BF-EEFB-4D23-9F86-B41B4850223E",
              "versionEndIncluding": "8.1\\(1\\)",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The IPv6 implementation on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) exposes IP services on the \"far side of the box,\" which might allow remote attackers to bypass intended access restrictions via IPv6 packets, aka Bug ID CSCso58622."
    },
    {
      "lang": "es",
      "value": "La implementaci\u00f3n de IPv6 en dispositivos Cisco Adaptive Security Appliances (ASA) de la serie 5580 con versi\u00f3n de software anterior a v8.1(2) muestra servicios IP desde \"la interfaz externa\" (\"far side of the box\"), que podr\u00edan permitir a atacantes remotos evitar rectricciones de acceso establecidas a trav\u00e9s de paquetes IPv6, tambi\u00e9n conocido como Bug ID CSCso58622."
    }
  ],
  "id": "CVE-2009-4913",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-06-29T18:30:01.520",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.cisco.com/en/US/docs/security/asa/asa81/release/notes/asarn812.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.cisco.com/en/US/docs/security/asa/asa81/release/notes/asarn812.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.