var-201203-0066
Vulnerability from variot
Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.4 before 8.4(2.11) and 8.5 before 8.5(1.4) allow remote attackers to cause a denial of service (device reload) via (1) IPv4 or (2) IPv6 packets that trigger syslog message 305006, aka Bug ID CSCts39634. Cisco ASA is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause an affected device to reload, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCts39634. ----------------------------------------------------------------------
Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch
TITLE: Cisco Adaptive Security Appliances Multiple Denial of Service Vulnerabilities
SECUNIA ADVISORY ID: SA48423
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48423/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48423
RELEASE DATE: 2012-03-15
DISCUSS ADVISORY: http://secunia.com/advisories/48423/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/48423/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=48423
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in Cisco Adaptive Security Appliances (ASA), which can be exploited by malicious people to cause a DoS (Denial of Service).
1) An error exists in the UDP inspection engine due to improper flow handling and can be exploited to reload a device by sending a specially crafted sequence of UDP packets that transit the appliance.
SOLUTION: Update to a fixed version (please see the vendor's advisory for details).
PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.
ORIGINAL ADVISORY: Cisco: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-asa
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
Cisco has released free software updates that address these vulnerabilities. Workarounds are available to mitigate some of the vulnerabilities. Affected versions of Cisco ASA Software will vary depending on the specific vulnerability. Consult the "Software Versions and Fixes" section of this security advisory for more information about the affected version.
Cisco PIX Security Appliances may be affected by some of the vulnerabilities described in this security advisory. Cisco PIX has reached end of maintenance support.
Vulnerable Products +------------------
For specific version information, refer to the "Software Versions and Fixes" section of this advisory.
All UDP protocols that are being inspected by the Cisco ASA UDP inspection engine may be vulnerable. The following protocols are known to use the Cisco ASA UDP inspection engine:
- Domain Name System (DNS)
- Session Initiation Protocol (SIP)
- Simple Network Management Protocol (SNMP)
- GPRS Tunneling Protocol (GTP)
- H.323, H.225 RAS
- Media Gateway Control Protocol (MGCP)
- SunRPC
- Trivial File Transfer Protocol (TFTP)
- X Display Manager Control Protocol (XDMCP)
- IBM NetBios
- Instant Messaging (depending on the particular IM client/solution being used)
Note: UDP inspection engines may be enabled by default on Cisco ASA Software. Please consult your user guide for more information.
The default inspected ports are listed at the following link: http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/inspect_overview.html
Note: The Cisco ASA UDP inspection can be applied to non-default UDP ports via class-map and policy-map commands. Any instance of use of the Cisco ASA UDP inspection engines may be vulnerable to this vulnerability, thus, configurations that include non-default UDP ports but use the Cisco ASA UDP inspection engine are considered vulnerable.
To determine whether any of the above inspections are enabled, issue
the show service-policy | include
ciscoasa# show service-policy | include netbios
Inspect: netbios, packet 0, drop 0, reset-drop 0
Cisco ASA Threat Detection Denial of Service Vulnerability +---------------------------------------------------------
The Cisco ASA Threat Detection feature, when configured with the Scanning Threat Mode feature and with shun option enabled, contains a vulnerability that could allow a remote unauthenticated attacker to trigger a reload of the Cisco ASA. This feature is not enabled by default.
To determine whether the Cisco ASA Threat Detection with Scanning Threat feature and shun option is enabled, issue the show running-config threat-detection scanning-threat command and confirm that the returned output includes the shun option.
Syslog message ID 305006 is generated when the Cisco ASA is unable to create a network address translation for a new connection. Additional information regarding this syslog message can be found in the Cisco ASA System Log Messages guide at: http://www.cisco.com/en/US/products/ps6120/products_system_message_guides_list.html
Logging is not enabled by default on Cisco ASA, however, when logging is enabled, Cisco ASA will automatically enable syslog message 305006.
Cisco ASA Software may be affected by this vulnerability if the following conditions are satisfied:
- System logging is enabled and syslogs are configured to be sent to any syslog destination (including Buffer or ASDM for example)
- Cisco ASA Software is configured in any way to generate syslog message 305006
Syslog message 305006 has a default severity level of 3 (errors). Cisco ASA Software configured for logging at Level 3 or higher (that is Levels 3 through 7) may be vulnerable. To verify if logging is enabled, issue the show logging command. The following example shows a Cisco ASA with logging enabled and buffer logging enabled at Level 6 (informational):
ciscoasa# show logging
Syslog logging: enabled
Facility: 20
Timestamp logging: disabled
Standby logging: disabled
Debug-trace logging: disabled
Console logging: disabled
Monitor logging: disabled
Buffer logging: level informational, 2 messages logged
Trap logging: disabled
Permit-hostdown logging: disabled
History logging: disabled
Device ID: disabled
Mail logging: disabled
ASDM logging: disabled
Using a custom message list (created via the logging list command) that includes syslog message 305006, either by severity or by explicitly including the message ID, is also a vulnerable configuration.
The default severity level of syslog messages can be changed. If the default severity level of syslog message 305006 is changed and the device is configured to log to any destination at the new severity level, the device is vulnerable.
Note: This vulnerability was introduced after the implementation of the new Cisco ASA Identity Firewall (IDFW) feature. This feature is not enabled by default.
To verify if PIM is enabled on an interface use the show pim interface command and verify that the state on appears under the PIM column. The following example shows PIM enabled on the interface outside but disabled on the interface inside:
ciscoasa# show pim interface
Address Interface PIM Nbr Hello DR DR
Count Intvl Prior
192.168.1.1 outside on 0 30 1 this system
192.168.2.1 inside off 0 30 1 this system
Note: Cisco ASA is vulnerable if at least one interface state is marked with on under the PIM column of the show pim interface command output.
Determine the Running Software Version +-------------------------------------
To determine whether a vulnerable version of Cisco ASA Software is running on an appliance, administrators can issue the show version command. Cisco PIX has reached end of maintenance support. Cisco PIX customers are encouraged to migrate to Cisco ASA.
Details
The following section gives additional detail about each vulnerability.
Cisco ASA UDP Inspection Engine Denial of Service Vulnerability +--------------------------------------------------------------
Inspection engines are required for services that embed IP addressing information in the user data packet or that open secondary channels on dynamically assigned ports. Cisco ASA Software supports a number of inspection engines for UDP and TCP-based protocols. The vulnerability is due to improper flow handling by the inspection engine. An attacker could exploit this vulnerability by sending a specially crafted sequence through the affected system.
All UDP protocols that are inspected by the inspection engine may be vulnerable to this vulnerability. The following protocols are known to use UDP inspection engine:
- Domain Name System (DNS)
- Session Initiation Protocol (SIP)
- Simple Network Management Protocol (SNMP)
- GPRS Tunneling Protocol (GTP)
- H.323, H.225 RAS
- Media Gateway Control Protocol (MGCP)
- SunRPC
- Trivial File Transfer Protocol (TFTP)
- X Display Manager Control Protocol (XDMCP)
- IBM NetBios
- Instant Messaging (depending on the particular IM client/solution being used)
Inspection engines may be enabled by default on Cisco ASA Software. Please consult your user guide for more information. The default inspected ports are listed at the following link: http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/inspect_overview.html#wp1536127
Note: Only transit traffic can be used to exploit this vulnerability. This vulnerability affects both routed and transparent firewall mode in both single and multi-context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic. Only UDP traffic can trigger this vulnerability.
Cisco ASA Threat Detection Denial of Service Vulnerability +---------------------------------------------------------
The Cisco ASA Threat Detection feature consists of different levels of statistics gathered for various threats, as well as scanning threat detection, which determines when a host is performing a scan. Optionally, you can shun any hosts that are determined to be a scanning threat. The vulnerability is due to improper handling of the internal flaw that is triggered by the shun event. An attacker may exploit this vulnerability by sending IP packets through the affected system in a way that triggers the shun option of Threat Detection scanning feature.
Note: Only transit traffic can be used to exploit this vulnerability. This vulnerability affects both routed and transparent firewall mode only in single context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic. Syslog messages are assigned different severities (including debugging, informational, error and critical, for example) and can be sent to different logging destinations. An attacker could exploit this vulnerability by sending a sequence of packets that could trigger the generation of the syslog message.
Syslog message ID 305006 is generated when the Cisco ASA is unable to create a network address translation for a new connection. Additional information about this syslog message can be found in the Cisco ASA System Log Messages guide: http://www.cisco.com/en/US/products/ps6120/products_system_message_guides_list.html
Note: Only transit traffic can be used to exploit this vulnerability. This vulnerability affects both routed and transparent firewall mode in both single and multi-context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic.
Protocol-Independent Multicast Denial of Service Vulnerability +-------------------------------------------------------------
Multicast routing is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to multiple recipients.
Protocol-independent multicast (PIM) is a multicast routing protocol that is IP routing protocol-independent. PIM can leverage whatever unicast routing protocols are used to populate the unicast routing table, including EIGRP, OSPF, BGP, or static routes. PIM uses this unicast routing information to perform the multicast forwarding function, and is IP protocol-independent. Although PIM is called a multicast routing protocol, it actually uses the unicast routing table to perform the reverse path forwarding (RPF) check function instead of building a completely independent multicast routing table. PIM does not send or receive multicast routing updates between routers as do other routing protocols.
A vulnerability exists in the way PIM is implemented that may cause affected devices to reload during the processing of a PIM message when multicast routing is enabled. The vulnerability is due to improper handling of a PIM message. An attacker could exploit this vulnerability by sending a crafted PIM message to the affected system.
Note: This vulnerability affects Cisco ASA configured only in routed firewall mode and only in single context mode. This vulnerability can be triggered only by IPv4 PIM message as PIM over IPv6 is currently not supported.
Vulnerability Scoring Details
Cisco has scored the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this security advisory is in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability severity and helps organizations determine the urgency and priority of a response.
Cisco has provided a base and temporal score. Customers can also compute environmental scores that help determine the impact of the vulnerability in their own networks.
Cisco has provided additional information regarding CVSS at the following link: http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to compute the environmental impact for individual networks at the following link: http://intellishield.cisco.com/security/alertmanager/cvss
- CSCtq10441- UDP inspection engines denial of service vulnerability
CVSS Base Score - 7.1 Access Vector - Network Access Complexity - Medium Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete
CVSS Temporal Score - 5.9 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed
- CSCtw35765- Threat Detection Denial Of Service Vulnerability
CVSS Base Score - 7.1 Access Vector - Network Access Complexity - Medium Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete
CVSS Temporal Score - 5.9 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed
- CSCts39634 - Syslog Message 305006 Denial of Service Vulnerability
CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete
CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed
- CSCtr47517 - Protocol-Independent Multicast Denial of Service Vulnerability
CVSS Base Score - 7.8 Access Vector - Network Access Complexity - Low Authentication - None Confidentiality Impact - None Integrity Impact - None Availability Impact - Complete
CVSS Temporal Score - 6.4 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed
Impact
Successful exploitation of any of the vulnerabilities described in this security advisory may allow a remote, unauthenticated attacker to reload the affected system.
Software Versions and Fixes
When considering software upgrades, customers are advised to consult the Cisco Security Advisories and Responses archive at: http://www.cisco.com/go/psirt
Customers should review subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Cisco ASA UDP Inspection Engine Denial of Service Vulnerability +--------------------------------------------------------------
+-------------------------------------------------------------------+ | | Major | First | | Vulnerability | Release | Fixed | | | | Release | |--------------------------------------------+---------+------------| | | 7.0 | Not | | | | Affected | | |---------+------------| | | 7.1 | Not | | | | Affected | | |---------+------------| | | 7.2 | Not | | | | Affected | | |---------+------------| | | 8.0 | 8.0(5.25) | |Cisco ASA UDP Inspection Engine Denial of |---------+------------| | Service Vulnerability - CSCtq10441 | 8.1 | 8.1(2.50) | | |---------+------------| | | 8.2 | 8.2(5.5) | | |---------+------------| | | 8.3 | 8.3(2.22) | | |---------+------------| | | 8.4 | 8.4(2.1) | | |---------+------------| | | 8.5 | 8.5(1.2) | | |---------+------------| | | 8.6 | Not | | | | Affected | +-------------------------------------------------------------------+
Cisco ASA Threat Detection Denial of Service Vulnerability +---------------------------------------------------------
+-------------------------------------------------------------------+ | Vulnerability | Major | First Fixed | | | Release | Release | |------------------------------------------+----------+-------------| | | 7.0 | Not | | | | Affected | | |----------+-------------| | | 7.1 | Not | | | | Affected | | |----------+-------------| | | 7.2 | Not | | | | Affected | | |----------+-------------| | | 8.0 | Migrate to | | | | 8.2(5.20) | |Cisco ASA Threat Detection Denial of |----------+-------------| | Service Vulnerability - CSCtw35765 | 8.1 | Migrate to | | | | 8.2(5.20) | | |----------+-------------| | | 8.2 | 8.2(5.20) | | |----------+-------------| | | 8.3 | 8.3(2.29) | | |----------+-------------| | | 8.4 | 8.4(3) | | |----------+-------------| | | 8.5 | 8.5(1.6) | | |----------+-------------| | | 8.6 | 8.6(1.1) | +-------------------------------------------------------------------+
Cisco ASA Syslog Message 305006 Denial of Service Vulnerability +--------------------------------------------------------------
+-------------------------------------------------------------------+ | | Major | First | | Vulnerability | Release | Fixed | | | | Release | |--------------------------------------------+---------+------------| | | 7.0 | Not | | | | Affected | | |---------+------------| | | 7.1 | Not | | | | Affected | | |---------+------------| | | 7.2 | Not | | | | Affected | | |---------+------------| | | 8.0 | Not | | | | Affected | | |---------+------------| | Cisco ASA Syslog Message 305006 Denial of | 8.1 | Not | | Service Vulnerability - CSCts39634 | | Affected | | |---------+------------| | | 8.2 | Not | | | | Affected | | |---------+------------| | | 8.3 | Not | | | | Affected | | |---------+------------| | | 8.4* | 8.4(2.11) | | |---------+------------| | | 8.5 | 8.5(1.4) | | |---------+------------| | | 8.6 | Not | | | | Affected | +-------------------------------------------------------------------+
*This vulnerability has been introduced after the implementation of a new Cisco ASA feature called Identity Firewall (IDFW).
Protocol-Independent Multicast Denial of Service Vulnerability +-------------------------------------------------------------
+-------------------------------------------------------------------+ | Vulnerability | Major | First Fixed | | | Release | Release | |-------------------------------------------+---------+-------------| | | 7.0 | Migrate to | | | | 7.2(5.7) | | |---------+-------------| | | 7.1 | Migrate to | | | | 7.2(5.7) | | |---------+-------------| | | 7.2 | 7.2(5.7) | | |---------+-------------| | | 8.0 | 8.0(5.27) | | |---------+-------------| | Protocol-Independent Multicast Denial of | 8.1 | 8.1(2.53) | |Service Vulnerability - CSCtr47517 |---------+-------------| | | 8.2 | 8.2(5.8) | | |---------+-------------| | | 8.3 | 8.3(2.25) | | |---------+-------------| | | 8.4 | 8.4(2.5) | | |---------+-------------| | | 8.5 | 8.5(1.2) | | |---------+-------------| | | 8.6 | Not | | | | Affected | +-------------------------------------------------------------------+
Recommended Releases +-------------------
The following table lists all recommended releases. These recommended releases contain the fixes for all vulnerabilities in this advisory. Cisco recommends upgrading to a release that is equal to or later than these recommended releases. Please note that some of these versions are interim versions and they can be found by expanding the Interim tab on the download page. Please note that some of these versions are interim versions and they can be found by expanding the Interim tab on the download page.
Workarounds
The following section will detail the workaround if available for each vulnerability detailed in this security advisory.
Cisco ASA Threat Detection Denial of Service Vulnerability +---------------------------------------------------------
If the shun option needs to be enabled, there are no workarounds that mitigate this vulnerability. However, if this option is not required, you can workaround this vulnerability by disabling this option.
This can be done by issuing the no threat-detection scanning-threat shun command. The threat-detection scanning-threat command can be used afterwards to configure the feature without the shun option.
To verify that the shun option has been correctly removed, issue the show running-config threat-detection scanning-threat command and confirm that the returned output does not show the shun option. The following example shows a Cisco ASA configured with the threat-detection scanning-threat feature without the shun option enabled:
ciscoasa# show running-config threat-detection scanning-threat
threat-detection scanning-threat
Cisco ASA Syslog Message 305006 Denial of Service Vulnerability +--------------------------------------------------------------
A possible workaround is to prevent the Cisco ASA from generating the particular syslog message. This can be done by issuing the no logging message 305006 command.
To verify that the message is not being generated issue show running-configuration logging command. The following example shows the output of the command when the logging of message 305006 is disabled:
ciscoasa# show run logging
[...]
no logging message 305006
[...]
Protocol-Independent Multicast Denial of Service Vulnerability +-------------------------------------------------------------
If PIM is required to be enabled, then there are no workarounds that mitigate this vulnerability. However,
if multicast routing is required but PIM is not used, PIM can be disabled on the Cisco ASA interfaces by issuing the no pim interface-level command.
The following example shows the interface Ethernet0/0 on a Cisco ASA device with PIM disabled:
interface Ethernet0/0
nameif outside
security-level 0
ip address 192.168.1.1 255.255.255.0
no pim
To verify that PIM is disabled on all interfaces, issue the show pim interface command and make sure that for all interface the PIM state is set to off.
ciscoasa# show pim interface
Address Interface PIM Nbr Hello DR DR
Count Intvl Prior
192.168.1.1 outside off 0 30 1 this system
192.168.2.1 inside off 0 30 1 this system
Obtaining Fixed Software
Cisco has released free software updates that address the vulnerabilities described in this advisory. Prior to deploying software, customers are advised to consult their maintenance providers or check the software for feature set compatibility and known issues that are specific to their environments.
Customers may only install and expect support for feature sets they have purchased. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html Or as set forth at: http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades.
Customers with Service Contracts +-------------------------------
Customers with contracts should obtain upgraded software through their regular update channels. For most customers, upgrades should be obtained through the Software Center on Cisco.com at http:// www.cisco.com.
Customers Using Third-Party Support Organizations +------------------------------------------------
Customers with Cisco products that are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers, should contact that organization for assistance with the appropriate course of action.
The effectiveness of any workaround or fix depends on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Because of the variety of affected products and releases, customers should consult their service providers or support organizations to ensure that any applied workaround or fix is the most appropriate in the intended network before it is deployed
Customers Without Service Contracts +----------------------------------
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC):
- +1 800 553 2447 (toll free from within North America)
- +1 408 526 7209 (toll call from anywhere in the world)
- e-mail: tac@cisco.com
Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Customers without service contracts should request free upgrades through the TAC.
Refer to Cisco Worldwide Contacts at: http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html For additional TAC contact information, including localized telephone numbers, instructions, and e-mail addresses for support in various languages.
Exploitation and Public Announcements
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory
All the vulnerabilities described in this security advisory were found during internal testing or discovered during the resolution of customer support cases.
Status of This Notice: Final
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.
Distribution
This advisory is posted on Cisco Security Intelligence Operations at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-asa
Additionally, a text version of this advisory is clear signed with the Cisco PSIRT PGP key and circulated among the following e-mail addresses:
- cust-security-announce@cisco.com
- first-bulletins@lists.first.org
- bugtraq@securityfocus.com
- vulnwatch@vulnwatch.org
- cisco@spot.colorado.edu
- cisco-nsp@puck.nether.net
- full-disclosure@lists.grok.org.uk
Future updates of this advisory, if any, will reside on Cisco.com but may not be announced on mailing lists. Users can monitor this advisory's URL for any updates.
Revision History
+-------------------------------------------------------------------+ | Revision 1.0 | 2012-March-14 | Initial Public Release | +-------------------------------------------------------------------+
Cisco Security Procedures
Complete information about reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco is available on Cisco.com at: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html This web page includes instructions for press inquiries regarding Cisco Security Advisories. All Cisco Security Advisories are available at: http://www.cisco.com/go/psirt
+-------------------------------------------------------------------- Copyright 2010-2011 Cisco Systems, Inc. All rights reserved. +-------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org
iF4EAREIAAYFAk9gqDoACgkQQXnnBKKRMNARMQD/WQOf+nO2va97P54EDmGQpuXf 0Rm/exibVufqYdrI0/QA/jac0kP0z5zoPO2A9wZNoRjw7rY542auiuxbovqiYKGm =HXUs -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201203-0066",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.4\\(1.11\\)"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.4\\(2\\)"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.5\\(1\\)"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.5"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.5\\(1.4\\)"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.4"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.4\\(1\\)"
},
{
"model": "adaptive security appliance software",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "8.4\\(2.11\\)"
},
{
"model": "5500 series adaptive security appliance",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"model": "catalyst 6509-e",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "catalyst 6500",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"model": "catalyst 6509-v-e",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "catalyst 6513",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "catalyst 6504-e",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "catalyst 6503-e",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "catalyst 6506-e",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "catalyst 6513-e",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "catalyst 6509-neb-a",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": null
},
{
"model": "catalyst 6500 series",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "8.5"
},
{
"model": "catalyst 6500 series",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "8.4"
},
{
"model": "catalyst 6500 series",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "device software 8.4(2.11)"
},
{
"model": "adaptive security appliance 5500 series",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "8.5"
},
{
"model": "catalyst 6500 series",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "device software 8.5(1.4)"
},
{
"model": "adaptive security appliance 5500 series",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "device software 8.4(2.11)"
},
{
"model": "adaptive security appliance 5500 series",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "8.4"
},
{
"model": "adaptive security appliance 5500 series",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco",
"version": "device software 8.5(1.4)"
},
{
"model": "catalyst series asa services module",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "65008.5(1.2)"
},
{
"model": "catalyst series asa services module",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "65008.5"
},
{
"model": "catalyst series asa services module",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "65008.4(2.5)"
},
{
"model": "catalyst series asa services module",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "65008.4(2.1)"
},
{
"model": "catalyst series asa services module",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "65008.4"
},
{
"model": "asa series adaptive security appliance",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.5(1.2)"
},
{
"model": "asa series adaptive security appliance",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.5(1.1)"
},
{
"model": "asa series adaptive security appliance",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.5"
},
{
"model": "asa series adaptive security appliance",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.4(2.7)"
},
{
"model": "asa series adaptive security appliance",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.4(2.5)"
},
{
"model": "asa series adaptive security appliance",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.4(2.1)"
},
{
"model": "asa series adaptive security appliance",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.4(2)"
},
{
"model": "asa series adaptive security appliance",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.4(1.10)"
},
{
"model": "asa series adaptive security appliance",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.4(1)"
},
{
"model": "asa series adaptive security appliance",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.4"
},
{
"model": "catalyst series asa services module",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "65008.5(1.4)"
},
{
"model": "catalyst series asa services module",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "65008.4(2.11)"
},
{
"model": "asa series adaptive security appliance",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.5(1.4)"
},
{
"model": "asa series adaptive security appliance",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "55008.4(2.11)"
}
],
"sources": [
{
"db": "BID",
"id": "52488"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-001796"
},
{
"db": "NVD",
"id": "CVE-2012-0355"
},
{
"db": "CNNVD",
"id": "CNNVD-201203-268"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.4\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.4\\(1.11\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.4\\(2\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.4\\(2.11\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.5\\(1\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:cisco:adaptive_security_appliance_software:8.5\\(1.4\\):*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:cisco:5500_series_adaptive_security_appliance:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:catalyst_6500:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:catalyst_6503-e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:catalyst_6504-e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:catalyst_6506-e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:catalyst_6509-e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:catalyst_6509-neb-a:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:catalyst_6509-v-e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:catalyst_6513:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:catalyst_6513-e:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-0355"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco",
"sources": [
{
"db": "BID",
"id": "52488"
}
],
"trust": 0.3
},
"cve": "CVE-2012-0355",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 6.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.8,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2012-0355",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-53636",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2012-0355",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201203-268",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-53636",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-53636"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-001796"
},
{
"db": "NVD",
"id": "CVE-2012-0355"
},
{
"db": "CNNVD",
"id": "CNNVD-201203-268"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.4 before 8.4(2.11) and 8.5 before 8.5(1.4) allow remote attackers to cause a denial of service (device reload) via (1) IPv4 or (2) IPv6 packets that trigger syslog message 305006, aka Bug ID CSCts39634. Cisco ASA is prone to a remote denial-of-service vulnerability. \nAn attacker can exploit this issue to cause an affected device to reload, denying service to legitimate users. \nThis issue is being tracked by Cisco Bug ID CSCts39634. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nCisco Adaptive Security Appliances Multiple Denial of Service\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA48423\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/48423/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48423\n\nRELEASE DATE:\n2012-03-15\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/48423/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/48423/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48423\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in Cisco Adaptive\nSecurity Appliances (ASA), which can be exploited by malicious people\nto cause a DoS (Denial of Service). \n\n1) An error exists in the UDP inspection engine due to improper flow\nhandling and can be exploited to reload a device by sending a\nspecially crafted sequence of UDP packets that transit the\nappliance. \n\nSOLUTION:\nUpdate to a fixed version (please see the vendor\u0027s advisory for\ndetails). \n\nPROVIDED AND/OR DISCOVERED BY:\nReported by the vendor. \n\nORIGINAL ADVISORY:\nCisco:\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-asa\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\nCisco has released free software updates that address these\nvulnerabilities. Workarounds are available to mitigate some of the\nvulnerabilities. Affected versions of Cisco ASA Software will vary\ndepending on the specific vulnerability. Consult the \"Software\nVersions and Fixes\" section of this security advisory for more\ninformation about the affected version. \n\nCisco PIX Security Appliances may be affected by some of the\nvulnerabilities described in this security advisory. Cisco PIX has\nreached end of maintenance support. \n\nVulnerable Products\n+------------------\n\nFor specific version information, refer to the \"Software Versions and\nFixes\" section of this advisory. \n\nAll UDP protocols that are being inspected by the Cisco ASA UDP\ninspection engine may be vulnerable. The following protocols are known\nto use the Cisco ASA UDP inspection engine:\n\n * Domain Name System (DNS)\n * Session Initiation Protocol (SIP)\n * Simple Network Management Protocol (SNMP)\n * GPRS Tunneling Protocol (GTP)\n * H.323, H.225 RAS\n * Media Gateway Control Protocol (MGCP)\n * SunRPC\n * Trivial File Transfer Protocol (TFTP)\n * X Display Manager Control Protocol (XDMCP)\n * IBM NetBios\n * Instant Messaging (depending on the particular IM client/solution\n being used)\n\nNote: UDP inspection engines may be enabled by default on Cisco ASA\nSoftware. Please consult your user guide for more information. \n\nThe default inspected ports are listed at the following link:\nhttp://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/inspect_overview.html\n\nNote: The Cisco ASA UDP inspection can be applied to non-default UDP\nports via class-map and policy-map commands. Any instance of use of\nthe Cisco ASA UDP inspection engines may be vulnerable to this\nvulnerability, thus, configurations that include non-default UDP ports\nbut use the Cisco ASA UDP inspection engine are considered vulnerable. \n\nTo determine whether any of the above inspections are enabled, issue\nthe show service-policy | include \u003cinspection engine name\u003e command and\nconfirm that the command returns output. The following example shows a\nCisco ASA configured to inspect IBM NetBIOS traffic:\n\n ciscoasa# show service-policy | include netbios\n Inspect: netbios, packet 0, drop 0, reset-drop 0\n\n\nCisco ASA Threat Detection Denial of Service Vulnerability\n+---------------------------------------------------------\n\nThe Cisco ASA Threat Detection feature, when configured with the\nScanning Threat Mode feature and with shun option enabled, contains a\nvulnerability that could allow a remote unauthenticated attacker to\ntrigger a reload of the Cisco ASA. This feature is not enabled by\ndefault. \n\nTo determine whether the Cisco ASA Threat Detection with Scanning\nThreat feature and shun option is enabled, issue the show\nrunning-config threat-detection scanning-threat command and confirm\nthat the returned output includes the shun option. \n\nSyslog message ID 305006 is generated when the Cisco ASA is unable to\ncreate a network address translation for a new connection. Additional\ninformation regarding this syslog message can be found in the Cisco\nASA System Log Messages guide at: \nhttp://www.cisco.com/en/US/products/ps6120/products_system_message_guides_list.html \n\nLogging is not enabled by default on Cisco ASA, however, when logging\nis enabled, Cisco ASA will automatically enable syslog message 305006. \n\nCisco ASA Software may be affected by this vulnerability if the\nfollowing conditions are satisfied:\n\n * System logging is enabled and syslogs are configured to be sent\n to any syslog destination (including Buffer or ASDM for example)\n * Cisco ASA Software is configured in any way to generate syslog\n message 305006\n\nSyslog message 305006 has a default severity level of 3 (errors). \nCisco ASA Software configured for logging at Level 3 or higher (that\nis Levels 3 through 7) may be vulnerable. To verify if logging is\nenabled, issue the show logging command. The following example shows a\nCisco ASA with logging enabled and buffer logging enabled at Level 6\n(informational):\n\n ciscoasa# show logging\n Syslog logging: enabled\n Facility: 20\n Timestamp logging: disabled\n Standby logging: disabled\n Debug-trace logging: disabled\n Console logging: disabled\n Monitor logging: disabled\n Buffer logging: level informational, 2 messages logged\n Trap logging: disabled\n Permit-hostdown logging: disabled\n History logging: disabled\n Device ID: disabled\n Mail logging: disabled\n ASDM logging: disabled\n\n\nUsing a custom message list (created via the logging list command)\nthat includes syslog message 305006, either by severity or by\nexplicitly including the message ID, is also a vulnerable\nconfiguration. \n\nThe default severity level of syslog messages can be changed. If the\ndefault severity level of syslog message 305006 is changed and the\ndevice is configured to log to any destination at the new severity\nlevel, the device is vulnerable. \n\nNote: This vulnerability was introduced after the implementation of\nthe new Cisco ASA Identity Firewall (IDFW) feature. This feature is not enabled by default. \n\nTo verify if PIM is enabled on an interface use the show pim interface\ncommand and verify that the state on appears under the PIM column. The\nfollowing example shows PIM enabled on the interface outside but\ndisabled on the interface inside:\n\n ciscoasa# show pim interface\n\n Address Interface PIM Nbr Hello DR DR\n Count Intvl Prior\n\n 192.168.1.1 outside on 0 30 1 this system\n 192.168.2.1 inside off 0 30 1 this system\n\n\nNote: Cisco ASA is vulnerable if at least one interface state is\nmarked with on under the PIM column of the show pim interface command\noutput. \n\n\nDetermine the Running Software Version\n+-------------------------------------\n\nTo determine whether a vulnerable version of Cisco ASA Software is\nrunning on an appliance, administrators can issue the show version\ncommand. Cisco PIX has reached end of maintenance\nsupport. Cisco PIX customers are encouraged to migrate to Cisco ASA. \n\n\nDetails\n=======\n\nThe following section gives additional detail about each vulnerability. \n\n\nCisco ASA UDP Inspection Engine Denial of Service Vulnerability\n+--------------------------------------------------------------\n\nInspection engines are required for services that embed IP addressing\ninformation in the user data packet or that open secondary channels on\ndynamically assigned ports. Cisco ASA Software supports a number of\ninspection engines for UDP and TCP-based protocols. The\nvulnerability is due to improper flow handling by the inspection\nengine. An attacker could exploit this vulnerability by sending a\nspecially crafted sequence through the affected system. \n\nAll UDP protocols that are inspected by the inspection engine may be\nvulnerable to this vulnerability. The following protocols are known to\nuse UDP inspection engine:\n\n * Domain Name System (DNS)\n * Session Initiation Protocol (SIP)\n * Simple Network Management Protocol (SNMP)\n * GPRS Tunneling Protocol (GTP)\n * H.323, H.225 RAS\n * Media Gateway Control Protocol (MGCP)\n * SunRPC\n * Trivial File Transfer Protocol (TFTP)\n * X Display Manager Control Protocol (XDMCP)\n * IBM NetBios\n * Instant Messaging (depending on the particular IM client/solution\n being used)\n\nInspection engines may be enabled by default on Cisco ASA Software. \nPlease consult your user guide for more information. The default\ninspected ports are listed at the following link:\nhttp://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/inspect_overview.html#wp1536127\n\nNote: Only transit traffic can be used to exploit this vulnerability. \nThis vulnerability affects both routed and transparent firewall mode\nin both single and multi-context mode. This vulnerability can be\ntriggered by IPv4 and IPv6 traffic. Only UDP traffic can trigger this\nvulnerability. \n\n\nCisco ASA Threat Detection Denial of Service Vulnerability\n+---------------------------------------------------------\n\nThe Cisco ASA Threat Detection feature consists of different levels of\nstatistics gathered for various threats, as well as scanning threat\ndetection, which determines when a host is performing a scan. \nOptionally, you can shun any hosts that are determined to be a\nscanning threat. The vulnerability is\ndue to improper handling of the internal flaw that is triggered by the\nshun event. An attacker may exploit this vulnerability by sending IP\npackets through the affected system in a way that triggers the shun\noption of Threat Detection scanning feature. \n\nNote: Only transit traffic can be used to exploit this vulnerability. \nThis vulnerability affects both routed and transparent firewall mode\nonly in single context mode. This vulnerability can be triggered by\nIPv4 and IPv6 traffic. Syslog messages are assigned different\nseverities (including debugging, informational, error and critical,\nfor example) and can be sent to different logging destinations. An\nattacker could exploit this vulnerability by sending a sequence of\npackets that could trigger the generation of the syslog message. \n\nSyslog message ID 305006 is generated when the Cisco ASA is unable to\ncreate a network address translation for a new connection. Additional\ninformation about this syslog message can be found in the Cisco ASA\nSystem Log Messages guide: \nhttp://www.cisco.com/en/US/products/ps6120/products_system_message_guides_list.html\n\nNote: Only transit traffic can be used to exploit this vulnerability. \nThis vulnerability affects both routed and transparent firewall mode\nin both single and multi-context mode. This vulnerability can be\ntriggered by IPv4 and IPv6 traffic. \n\n\nProtocol-Independent Multicast Denial of Service Vulnerability\n+-------------------------------------------------------------\n\nMulticast routing is a bandwidth-conserving technology that reduces\ntraffic by simultaneously delivering a single stream of information to\nmultiple recipients. \n\nProtocol-independent multicast (PIM) is a multicast routing protocol\nthat is IP routing protocol-independent. PIM can leverage whatever\nunicast routing protocols are used to populate the unicast routing\ntable, including EIGRP, OSPF, BGP, or static routes. PIM uses this\nunicast routing information to perform the multicast forwarding\nfunction, and is IP protocol-independent. Although PIM is called a\nmulticast routing protocol, it actually uses the unicast routing table\nto perform the reverse path forwarding (RPF) check function instead of\nbuilding a completely independent multicast routing table. PIM does\nnot send or receive multicast routing updates between routers as do\nother routing protocols. \n\nA vulnerability exists in the way PIM is implemented that may cause\naffected devices to reload during the processing of a PIM message when\nmulticast routing is enabled. The vulnerability is due to improper\nhandling of a PIM message. An attacker could exploit this\nvulnerability by sending a crafted PIM message to the affected system. \n\nNote: This vulnerability affects Cisco ASA configured only in routed\nfirewall mode and only in single context mode. This vulnerability can\nbe triggered only by IPv4 PIM message as PIM over IPv6 is currently\nnot supported. \n\n\nVulnerability Scoring Details\n=============================\n\nCisco has scored the vulnerabilities in this advisory based on the\nCommon Vulnerability Scoring System (CVSS). The CVSS scoring in this\nsecurity advisory is in accordance with CVSS version 2.0. \n\nCVSS is a standards-based scoring method that conveys vulnerability\nseverity and helps organizations determine the urgency and priority of\na response. \n\nCisco has provided a base and temporal score. Customers can also\ncompute environmental scores that help determine the impact of the\nvulnerability in their own networks. \n\nCisco has provided additional information regarding CVSS at the\nfollowing link:\nhttp://www.cisco.com/web/about/security/intelligence/cvss-qandas.html\n\nCisco has also provided a CVSS calculator to compute the environmental\nimpact for individual networks at the following link:\nhttp://intellishield.cisco.com/security/alertmanager/cvss\n\n\n* CSCtq10441- UDP inspection engines denial of service vulnerability\n\nCVSS Base Score - 7.1\n Access Vector - Network\n Access Complexity - Medium\n Authentication - None\n Confidentiality Impact - None\n Integrity Impact - None\n Availability Impact - Complete\n\nCVSS Temporal Score - 5.9\n Exploitability - Functional\n Remediation Level - Official-Fix\n Report Confidence - Confirmed\n\n\n* CSCtw35765- Threat Detection Denial Of Service Vulnerability\n\nCVSS Base Score - 7.1\n Access Vector - Network\n Access Complexity - Medium\n Authentication - None\n Confidentiality Impact - None\n Integrity Impact - None\n Availability Impact - Complete\n\nCVSS Temporal Score - 5.9\n Exploitability - Functional\n Remediation Level - Official-Fix\n Report Confidence - Confirmed\n\n\n* CSCts39634 - Syslog Message 305006 Denial of Service Vulnerability\n\nCVSS Base Score - 7.8\n Access Vector - Network\n Access Complexity - Low\n Authentication - None\n Confidentiality Impact - None\n Integrity Impact - None\n Availability Impact - Complete\n\nCVSS Temporal Score - 6.4\n Exploitability - Functional\n Remediation Level - Official-Fix\n Report Confidence - Confirmed\n\n\n* CSCtr47517 - Protocol-Independent Multicast Denial of Service Vulnerability\n\nCVSS Base Score - 7.8\n Access Vector - Network\n Access Complexity - Low\n Authentication - None\n Confidentiality Impact - None\n Integrity Impact - None\n Availability Impact - Complete\n\nCVSS Temporal Score - 6.4\n Exploitability - Functional\n Remediation Level - Official-Fix\n Report Confidence - Confirmed\n\n\nImpact\n======\n\nSuccessful exploitation of any of the vulnerabilities described in\nthis security advisory may allow a remote, unauthenticated attacker to\nreload the affected system. \n\n\nSoftware Versions and Fixes\n===========================\n\nWhen considering software upgrades, customers are advised to consult\nthe Cisco Security Advisories and Responses archive at:\nhttp://www.cisco.com/go/psirt\n\nCustomers should review subsequent advisories to determine exposure\nand a complete upgrade solution. \n\nIn all cases, customers should ensure that the devices to be upgraded\ncontain sufficient memory and confirm that current hardware and\nsoftware configurations will continue to be supported properly by the\nnew release. If the information is not clear, customers are advised to\ncontact the Cisco Technical Assistance Center (TAC) or their\ncontracted maintenance providers. \n\nCisco ASA UDP Inspection Engine Denial of Service Vulnerability\n+--------------------------------------------------------------\n\n+-------------------------------------------------------------------+\n| | Major | First |\n| Vulnerability | Release | Fixed |\n| | | Release |\n|--------------------------------------------+---------+------------|\n| | 7.0 | Not |\n| | | Affected |\n| |---------+------------|\n| | 7.1 | Not |\n| | | Affected |\n| |---------+------------|\n| | 7.2 | Not |\n| | | Affected |\n| |---------+------------|\n| | 8.0 | 8.0(5.25) |\n|Cisco ASA UDP Inspection Engine Denial of |---------+------------|\n| Service Vulnerability - CSCtq10441 | 8.1 | 8.1(2.50) |\n| |---------+------------|\n| | 8.2 | 8.2(5.5) |\n| |---------+------------|\n| | 8.3 | 8.3(2.22) |\n| |---------+------------|\n| | 8.4 | 8.4(2.1) |\n| |---------+------------|\n| | 8.5 | 8.5(1.2) |\n| |---------+------------|\n| | 8.6 | Not |\n| | | Affected |\n+-------------------------------------------------------------------+\n\n\nCisco ASA Threat Detection Denial of Service Vulnerability\n+---------------------------------------------------------\n\n+-------------------------------------------------------------------+\n| Vulnerability | Major | First Fixed |\n| | Release | Release |\n|------------------------------------------+----------+-------------|\n| | 7.0 | Not |\n| | | Affected |\n| |----------+-------------|\n| | 7.1 | Not |\n| | | Affected |\n| |----------+-------------|\n| | 7.2 | Not |\n| | | Affected |\n| |----------+-------------|\n| | 8.0 | Migrate to |\n| | | 8.2(5.20) |\n|Cisco ASA Threat Detection Denial of |----------+-------------|\n| Service Vulnerability - CSCtw35765 | 8.1 | Migrate to |\n| | | 8.2(5.20) |\n| |----------+-------------|\n| | 8.2 | 8.2(5.20) |\n| |----------+-------------|\n| | 8.3 | 8.3(2.29) |\n| |----------+-------------|\n| | 8.4 | 8.4(3) |\n| |----------+-------------|\n| | 8.5 | 8.5(1.6) |\n| |----------+-------------|\n| | 8.6 | 8.6(1.1) |\n+-------------------------------------------------------------------+\n\n\nCisco ASA Syslog Message 305006 Denial of Service Vulnerability\n+--------------------------------------------------------------\n\n+-------------------------------------------------------------------+\n| | Major | First |\n| Vulnerability | Release | Fixed |\n| | | Release |\n|--------------------------------------------+---------+------------|\n| | 7.0 | Not |\n| | | Affected |\n| |---------+------------|\n| | 7.1 | Not |\n| | | Affected |\n| |---------+------------|\n| | 7.2 | Not |\n| | | Affected |\n| |---------+------------|\n| | 8.0 | Not |\n| | | Affected |\n| |---------+------------|\n| Cisco ASA Syslog Message 305006 Denial of | 8.1 | Not |\n| Service Vulnerability - CSCts39634 | | Affected |\n| |---------+------------|\n| | 8.2 | Not |\n| | | Affected |\n| |---------+------------|\n| | 8.3 | Not |\n| | | Affected |\n| |---------+------------|\n| | 8.4* | 8.4(2.11) |\n| |---------+------------|\n| | 8.5 | 8.5(1.4) |\n| |---------+------------|\n| | 8.6 | Not |\n| | | Affected |\n+-------------------------------------------------------------------+\n\n*This vulnerability has been introduced after the implementation of a\nnew Cisco ASA feature called Identity Firewall (IDFW). \n\n\nProtocol-Independent Multicast Denial of Service Vulnerability\n+-------------------------------------------------------------\n\n+-------------------------------------------------------------------+\n| Vulnerability | Major | First Fixed |\n| | Release | Release |\n|-------------------------------------------+---------+-------------|\n| | 7.0 | Migrate to |\n| | | 7.2(5.7) |\n| |---------+-------------|\n| | 7.1 | Migrate to |\n| | | 7.2(5.7) |\n| |---------+-------------|\n| | 7.2 | 7.2(5.7) |\n| |---------+-------------|\n| | 8.0 | 8.0(5.27) |\n| |---------+-------------|\n| Protocol-Independent Multicast Denial of | 8.1 | 8.1(2.53) |\n|Service Vulnerability - CSCtr47517 |---------+-------------|\n| | 8.2 | 8.2(5.8) |\n| |---------+-------------|\n| | 8.3 | 8.3(2.25) |\n| |---------+-------------|\n| | 8.4 | 8.4(2.5) |\n| |---------+-------------|\n| | 8.5 | 8.5(1.2) |\n| |---------+-------------|\n| | 8.6 | Not |\n| | | Affected |\n+-------------------------------------------------------------------+\n\nRecommended Releases\n+-------------------\n\nThe following table lists all recommended releases. These recommended\nreleases contain the fixes for all vulnerabilities in this advisory. \nCisco recommends upgrading to a release that is equal to or later than\nthese recommended releases. Please note that some of\nthese versions are interim versions and they can be found by expanding\nthe Interim tab on the download page. Please note that some of these versions are interim\nversions and they can be found by expanding the Interim tab on the\ndownload page. \n\n\nWorkarounds\n===========\n\nThe following section will detail the workaround if available for each\nvulnerability detailed in this security advisory. \n\n\nCisco ASA Threat Detection Denial of Service Vulnerability\n+---------------------------------------------------------\n\nIf the shun option needs to be enabled, there are no workarounds that\nmitigate this vulnerability. However, if this option is not required,\nyou can workaround this vulnerability by disabling this option. \n\nThis can be done by issuing the no threat-detection scanning-threat\nshun command. The threat-detection scanning-threat command can be used\nafterwards to configure the feature without the shun option. \n\nTo verify that the shun option has been correctly removed, issue the\nshow running-config threat-detection scanning-threat command and\nconfirm that the returned output does not show the shun option. The\nfollowing example shows a Cisco ASA configured with the\nthreat-detection scanning-threat feature without the shun option\nenabled:\n\n ciscoasa# show running-config threat-detection scanning-threat\n threat-detection scanning-threat\n\n\nCisco ASA Syslog Message 305006 Denial of Service Vulnerability\n+--------------------------------------------------------------\n\nA possible workaround is to prevent the Cisco ASA from generating the\nparticular syslog message. This can be done by issuing the no logging\nmessage 305006 command. \n\nTo verify that the message is not being generated issue show\nrunning-configuration logging command. The following example shows the\noutput of the command when the logging of message 305006 is disabled:\n\n ciscoasa# show run logging\n [...]\n no logging message 305006\n [...]\n\n\nProtocol-Independent Multicast Denial of Service Vulnerability\n+-------------------------------------------------------------\n\nIf PIM is required to be enabled, then there are no workarounds that\nmitigate this vulnerability. However,\n\nif multicast routing is required but PIM is not used, PIM can be\ndisabled on the Cisco ASA interfaces by issuing the no pim\ninterface-level command. \n\nThe following example shows the interface Ethernet0/0 on a Cisco ASA\ndevice with PIM disabled:\n\n interface Ethernet0/0\n nameif outside\n security-level 0\n ip address 192.168.1.1 255.255.255.0\n no pim\n\nTo verify that PIM is disabled on all interfaces, issue the show pim\ninterface command and make sure that for all interface the PIM state\nis set to off. \n\n ciscoasa# show pim interface\n\n Address Interface PIM Nbr Hello DR DR\n Count Intvl Prior\n\n 192.168.1.1 outside off 0 30 1 this system\n 192.168.2.1 inside off 0 30 1 this system\n\n\nObtaining Fixed Software\n========================\n\nCisco has released free software updates that address the\nvulnerabilities described in this advisory. Prior to deploying\nsoftware, customers are advised to consult their maintenance providers\nor check the software for feature set compatibility and known issues\nthat are specific to their environments. \n\nCustomers may only install and expect support for feature sets they\nhave purchased. By installing, downloading, accessing, or otherwise\nusing such software upgrades, customers agree to follow the terms of\nthe Cisco software license at\nhttp://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html\nOr as set forth at:\nhttp://www.cisco.com/public/sw-center/sw-usingswc.shtml\n\nDo not contact psirt@cisco.com or security-alert@cisco.com for\nsoftware upgrades. \n\n\nCustomers with Service Contracts\n+-------------------------------\n\nCustomers with contracts should obtain upgraded software through their\nregular update channels. For most customers, upgrades should be\nobtained through the Software Center on Cisco.com at http://\nwww.cisco.com. \n\n\nCustomers Using Third-Party Support Organizations\n+------------------------------------------------\n\nCustomers with Cisco products that are provided or maintained through\nprior or existing agreements with third-party support organizations,\nsuch as Cisco Partners, authorized resellers, or service providers,\nshould contact that organization for assistance with the appropriate\ncourse of action. \n\nThe effectiveness of any workaround or fix depends on specific\ncustomer situations, such as product mix, network topology, traffic\nbehavior, and organizational mission. Because of the variety of\naffected products and releases, customers should consult their service\nproviders or support organizations to ensure that any applied\nworkaround or fix is the most appropriate in the intended network\nbefore it is deployed\n\n\nCustomers Without Service Contracts\n+----------------------------------\n\nCustomers who purchase directly from Cisco but do not hold a Cisco\nservice contract and customers who make purchases through third-party\nvendors but are unsuccessful in obtaining fixed software through their\npoint of sale should obtain upgrades by contacting the Cisco Technical\nAssistance Center (TAC):\n\n * +1 800 553 2447 (toll free from within North America)\n * +1 408 526 7209 (toll call from anywhere in the world)\n * e-mail: tac@cisco.com\n\nCustomers should have the product serial number available and be\nprepared to provide the URL of this advisory as evidence of\nentitlement to a free upgrade. Customers without service contracts\nshould request free upgrades through the TAC. \n\nRefer to Cisco Worldwide Contacts at:\nhttp://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html\nFor additional TAC contact information, including localized telephone\nnumbers, instructions, and e-mail addresses for support in various\nlanguages. \n\n\nExploitation and Public Announcements\n=====================================\n\nThe Cisco Product Security Incident Response Team (PSIRT) is not aware\nof any public announcements or malicious use of the vulnerabilities\nthat are described in this advisory\n\nAll the vulnerabilities described in this security advisory were found\nduring internal testing or discovered during the resolution of\ncustomer support cases. \n\n\nStatus of This Notice: Final\n============================\n\nTHIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY\nKIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF\nMERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE\nINFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS\nAT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS\nDOCUMENT AT ANY TIME. \n\nA stand-alone copy or Paraphrase of the text of this document that\nomits the distribution URL in the following section is an uncontrolled\ncopy, and may lack important information or contain factual errors. \n\n\nDistribution\n============\n\nThis advisory is posted on Cisco Security Intelligence Operations at\nthe following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-asa\n\nAdditionally, a text version of this advisory is clear signed with the\nCisco PSIRT PGP key and circulated among the following e-mail\naddresses:\n\n * cust-security-announce@cisco.com\n * first-bulletins@lists.first.org\n * bugtraq@securityfocus.com\n * vulnwatch@vulnwatch.org\n * cisco@spot.colorado.edu\n * cisco-nsp@puck.nether.net\n * full-disclosure@lists.grok.org.uk\n\nFuture updates of this advisory, if any, will reside on Cisco.com but\nmay not be announced on mailing lists. Users can monitor this\nadvisory\u0027s URL for any updates. \n\n\nRevision History\n================\n\n+-------------------------------------------------------------------+\n| Revision 1.0 | 2012-March-14 | Initial Public Release |\n+-------------------------------------------------------------------+\n\nCisco Security Procedures\n=========================\n\nComplete information about reporting security vulnerabilities in Cisco\nproducts, obtaining assistance with security incidents, and\nregistering to receive security information from Cisco is available on\nCisco.com at:\nhttp://www.cisco.com/en/US/products/products_security_vulnerability_policy.html\nThis web page includes instructions for press inquiries regarding\nCisco Security Advisories. All Cisco Security Advisories are available\nat:\nhttp://www.cisco.com/go/psirt\n\n+--------------------------------------------------------------------\nCopyright 2010-2011 Cisco Systems, Inc. All rights reserved. \n+--------------------------------------------------------------------\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG/MacGPG2 v2.0.17 (Darwin)\nComment: GPGTools - http://gpgtools.org\n\niF4EAREIAAYFAk9gqDoACgkQQXnnBKKRMNARMQD/WQOf+nO2va97P54EDmGQpuXf\n0Rm/exibVufqYdrI0/QA/jac0kP0z5zoPO2A9wZNoRjw7rY542auiuxbovqiYKGm\n=HXUs\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-0355"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-001796"
},
{
"db": "BID",
"id": "52488"
},
{
"db": "VULHUB",
"id": "VHN-53636"
},
{
"db": "PACKETSTORM",
"id": "110851"
},
{
"db": "PACKETSTORM",
"id": "110822"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-0355",
"trust": 2.9
},
{
"db": "BID",
"id": "52488",
"trust": 1.4
},
{
"db": "SECUNIA",
"id": "48423",
"trust": 1.2
},
{
"db": "OSVDB",
"id": "80045",
"trust": 1.1
},
{
"db": "SECTRACK",
"id": "1026800",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2012-001796",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201203-268",
"trust": 0.7
},
{
"db": "NSFOCUS",
"id": "19071",
"trust": 0.6
},
{
"db": "CISCO",
"id": "20120314 MULTIPLE VULNERABILITIES IN CISCO ASA 5500 SERIES ADAPTIVE SECURITY APPLIANCES AND CISCO CATALYST 6500 SERIES ASA SERVICES MODULE",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-53636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "110851",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "110822",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-53636"
},
{
"db": "BID",
"id": "52488"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-001796"
},
{
"db": "PACKETSTORM",
"id": "110851"
},
{
"db": "PACKETSTORM",
"id": "110822"
},
{
"db": "NVD",
"id": "CVE-2012-0355"
},
{
"db": "CNNVD",
"id": "CNNVD-201203-268"
}
]
},
"id": "VAR-201203-0066",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-53636"
}
],
"trust": 0.7311873
},
"last_update_date": "2023-12-18T12:31:06.679000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-20120314-asa",
"trust": 0.8,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20120314-asa"
},
{
"title": "cisco-sa-20120314-asa",
"trust": 0.8,
"url": "http://www.cisco.com/cisco/web/support/jp/111/1110/1110665_cisco-sa-20120314-asa-j.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-001796"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-53636"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-001796"
},
{
"db": "NVD",
"id": "CVE-2012-0355"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20120314-asa"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/52488"
},
{
"trust": 1.1,
"url": "http://osvdb.org/80045"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1026800"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/48423"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-0355"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-0355"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/19071"
},
{
"trust": 0.3,
"url": "http://www.cisco.com/en/us/products/ps6120/index.html"
},
{
"trust": 0.3,
"url": "http://www.cisco.com/en/us/products/ps11621/index.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/psi_30_beta_launch"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/48423/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/48423/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48423"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/go/psirt"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/cisco/software/navigator.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/docs/general/warranty/english/eu1ken_.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0356"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0353"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/support/tsd_cisco_worldwide_contacts.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html"
},
{
"trust": 0.1,
"url": "https://www.cisco.com."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/docs/security/asa/asa84/configuration/guide/inspect_overview.html#wp1536127"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20120314-fwsm"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/public/sw-center/sw-usingswc.shtml"
},
{
"trust": 0.1,
"url": "http://gpgtools.org"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/products_security_vulnerability_policy.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/docs/security/asa/asa84/configuration/guide/inspect_overview.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0354"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-0355"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/ps6120/products_system_message_guides_list.html"
},
{
"trust": 0.1,
"url": "http://intellishield.cisco.com/security/alertmanager/cvss"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-53636"
},
{
"db": "BID",
"id": "52488"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-001796"
},
{
"db": "PACKETSTORM",
"id": "110851"
},
{
"db": "PACKETSTORM",
"id": "110822"
},
{
"db": "NVD",
"id": "CVE-2012-0355"
},
{
"db": "CNNVD",
"id": "CNNVD-201203-268"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-53636"
},
{
"db": "BID",
"id": "52488"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-001796"
},
{
"db": "PACKETSTORM",
"id": "110851"
},
{
"db": "PACKETSTORM",
"id": "110822"
},
{
"db": "NVD",
"id": "CVE-2012-0355"
},
{
"db": "CNNVD",
"id": "CNNVD-201203-268"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-03-15T00:00:00",
"db": "VULHUB",
"id": "VHN-53636"
},
{
"date": "2012-03-14T00:00:00",
"db": "BID",
"id": "52488"
},
{
"date": "2012-03-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-001796"
},
{
"date": "2012-03-15T06:37:40",
"db": "PACKETSTORM",
"id": "110851"
},
{
"date": "2012-03-15T03:02:43",
"db": "PACKETSTORM",
"id": "110822"
},
{
"date": "2012-03-15T00:55:01.023000",
"db": "NVD",
"id": "CVE-2012-0355"
},
{
"date": "2012-03-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201203-268"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-01-13T00:00:00",
"db": "VULHUB",
"id": "VHN-53636"
},
{
"date": "2012-03-14T00:00:00",
"db": "BID",
"id": "52488"
},
{
"date": "2012-03-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-001796"
},
{
"date": "2023-08-15T14:41:35.310000",
"db": "NVD",
"id": "CVE-2012-0355"
},
{
"date": "2012-03-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201203-268"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201203-268"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Cisco Service disruption in products ( Device reload ) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-001796"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201203-268"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.