PT-2008-4179 · Cisco · Cisco Asa

Published 2008-09-03 · Updated 2017-08-08 · CVE-2008-2736

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) 5500 devices version 8.0(3)15 Cisco Adaptive Security Appliance (ASA) 5500 devices version 8.0(3)16 Cisco Adaptive Security Appliance (ASA) 5500 devices version 8.1(1)4 Cisco Adaptive Security Appliance (ASA) 5500 devices version 8.1(1)5

Description The issue allows remote attackers to obtain usernames and passwords via unknown vectors when the device is configured as a clientless SSL VPN endpoint. Multiple vulnerabilities may result in a reload of the device or disclosure of confidential information.

Recommendations For version 8.0(3)15, update to a fixed version to prevent remote attackers from obtaining usernames and passwords. For version 8.0(3)16, update to a fixed version to prevent remote attackers from obtaining usernames and passwords. For version 8.1(1)4, update to a fixed version to prevent remote attackers from obtaining usernames and passwords. For version 8.1(1)5, update to a fixed version to prevent remote attackers from obtaining usernames and passwords.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-2736

Affected Products

Cisco Asa

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2008-2736 · Security Note
• http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080903-asa · Vendor Advisory
• http://cisco.com/en/US/products/products_security_advisory09186a00809f138a.shtml · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080903-asa · Vendor Advisory
• http://secunia.com/advisories/31730 · Note
• http://securityfocus.com/bid/30998 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44870 · Note
• http://securitytracker.com/id?1020813 · Note
• http://cisco.com/en/US/docs/security/asa/asa81/release/notes/asarn812.html · Note