PT-2012-5529 · Cisco · Asa Services Module+2

Published 2012-10-10 · Updated 2023-08-11 · CVE-2012-4659

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliances (ASA) 5500 series devices versions 8.2 before 8.2(5.30) Cisco Adaptive Security Appliances (ASA) 5500 series devices versions 8.3 before 8.3(2.34) ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices versions 8.2 before 8.2(5.30) ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices versions 8.3 before 8.3(2.34)

Description The issue allows remote attackers to cause a denial of service via a crafted authentication response. Successful exploitation could allow an unauthenticated remote attacker to trigger a reload of the affected device. Additionally, exploitation could cause a stack overflow and possibly the execution of arbitrary commands.

Recommendations For versions 8.2 before 8.2(5.30), update to version 8.2(5.30) or later. For versions 8.3 before 8.3(2.34), update to version 8.3(2.34) or later. As a temporary workaround, consider restricting access to the AAA functionality until a patch is available.

Fix

DoS

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-4659

Affected Products

Asa Services Module

Cisco Asa

Cisco Catalyst 6500

References · 5

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-asa · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4659 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20121010-asa · Vendor Advisory
• http://osvdb.org/86137 · Note
• http://securityfocus.com/bid/55865 · Note