PT-2015-1055 · Cisco · Cisco Asa

Alec Stuart-Muirk · Publicado 2015-04-08 · Atualizado 2022-05-26 · CVE-2015-0675

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software versions 9.1 through 9.1(5) Cisco Adaptive Security Appliance (ASA) Software versions 9.2 through 9.2(3.2) Cisco Adaptive Security Appliance (ASA) Software versions 9.3 through 9.3(2)

Description The failover ipsec implementation in Cisco Adaptive Security Appliance (ASA) Software does not properly validate failover communication messages. This allows remote attackers to reconfigure an ASA device and obtain administrative control by sending crafted UDP packets over the local network to the failover interface.

Recommendations For versions 9.1 through 9.1(5), update to version 9.1(6) or later. For versions 9.2 through 9.2(3.2), update to version 9.2(3.3) or later. For versions 9.3 through 9.3(2), update to version 9.3(3) or later.

Correção

RCE

Improper Access Control

Enumeração de Fraquezas

CWE-20

CWE-284

Identificadores relacionados

BDU:2015-09910

CVE-2015-0675

Produtos afetados

Cisco Asa

Referências · 6

• https://bdu.fstec.ru/vul/2015-09910 · Nota de Segurança
• http://securitytracker.com/id/1032045 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-0675 · Nota de Segurança
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0675 · Nota de Segurança