PT-2013-6093 · Cisco · Cisco Asa

Publicado 2013-12-06 · Atualizado 2022-05-23 · CVE-2013-6707

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software version 9.1.3 and earlier

Description A memory leak in the connection-manager implementation allows remote attackers to cause a denial of service, resulting in a multi-protocol management outage. This can be achieved by making multiple management session requests via protocols such as SSH, Telnet, HTTP, and HTTPS, causing the system to become unresponsive to management session requests.

Recommendations For Cisco Adaptive Security Appliance (ASA) Software version 9.1.3 and earlier, consider restricting access to management session requests until a fix is available. As a temporary workaround, limit the number of concurrent management sessions to minimize the risk of exploitation. Avoid using the affected connection-manager implementation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Missing Release of Resource after Effective Lifetime

Enumeração de Fraquezas

CWE-772

Identificadores relacionados

CVE-2013-6707

Produtos afetados

Cisco Asa

Referências · 9

• http://tools.cisco.com/security/center/viewAlert.x?alertId=32065 · Aviso do Fabricante
• http://osvdb.org/100682 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89442 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6707 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6707 · Nota de Segurança
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131206-CVE-2013-6707 · Aviso do Fabricante
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6707 · Aviso do Fabricante
• http://securityfocus.com/bid/64148 · Nota
• http://securitytracker.com/id/1029441 · Nota