PT-2013-6071 · Cisco · Cisco Asa

Published 2013-11-11 · Updated 2023-08-15 · CVE-2013-6682

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software versions 9.0.3.6 and earlier

Description The phone-proxy implementation in Cisco Adaptive Security Appliance (ASA) Software does not properly validate X.509 certificates, allowing remote attackers to cause a denial of service (connection-database corruption) via an invalid entry. This issue could allow an unauthenticated, remote attacker to temporarily insert an invalid entry in the phone proxy connection database.

Recommendations For versions 9.0.3.6 and earlier, update to a version that properly validates X.509 certificates to prevent denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-6682

Affected Products

Cisco Asa

References · 6

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6682 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131111-CVE-2013-6682 · Vendor Advisory
• http://tools.cisco.com/security/center/viewAlert.x?alertId=31692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6682 · Security Note
• https://t.me/cvenotify/56304 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6682 · Note