PT-2016-6906 · Cisco · Cisco Asa

CVE-2016-6432 · Publicado 2016-10-19 · Atualizado 2023-08-15

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco ASA Software versions prior to 9.6(2.1)

Description A buffer overflow in the Identity Firewall feature could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability can be exploited by sending a crafted NetBIOS packet in response to a NetBIOS probe sent by the ASA software, allowing the attacker to execute arbitrary code and obtain full control of the system or cause a reload of the affected system. This issue affects systems configured in routed and transparent firewall mode and in single or multiple context mode, and can be triggered by IPv4 traffic.

Recommendations For versions prior to 9.6(2.1), update to version 9.6(2.1) or later to resolve the issue. As a temporary workaround, consider restricting access to the Identity Firewall feature until a patch is available. Avoid using the affected feature in production environments until the issue is resolved.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2016-6432

Produtos afetados

Cisco Asa

Referências · 5

• http://securityfocus.com/bid/93784 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-asa-idfw · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-6432 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6432 · Nota de Segurança
• http://securitytracker.com/id/1037059 · Nota