PT-2018-1303 · Cisco · Firepower Threat Defense+1

Publicado 2018-04-18 · Atualizado 2023-08-15 · CVE-2018-0228

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A vulnerability in the ingress flow creation functionality could allow an unauthenticated, remote attacker to cause the CPU to increase upwards of 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to incorrect handling of an internal software lock that could prevent other system processes from getting CPU cycles, causing a high CPU condition. An attacker could exploit this vulnerability by sending a steady stream of malicious IP packets that can cause connections to be created on the targeted device. This vulnerability applies to either IPv4 or IPv6 ingress traffic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Improper Locking

Enumeração de Fraquezas

CWE-20

CWE-667

CWE-399

Identificadores relacionados

BDU:2018-00801

CVE-2018-0228

Produtos afetados

Cisco Asa

Firepower Threat Defense

Referências · 8

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa2 · Aviso do Fabricante
• http://securitytracker.com/id/1040724 · Nota
• https://bdu.fstec.ru/vul/2018-00801 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-0228 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01 · Nota
• http://securityfocus.com/bid/104220 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0228 · Nota de Segurança
• https://cisa.gov/news-events/ics-advisories/icsa-18-184-01 · Nota