PT-2013-6093 · Cisco · Cisco Asa

Published 2013-12-06 · Updated 2022-05-23 · CVE-2013-6707

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software version 9.1.3 and earlier

Description A memory leak in the connection-manager implementation allows remote attackers to cause a denial of service, resulting in a multi-protocol management outage. This can be achieved by making multiple management session requests via protocols such as SSH, Telnet, HTTP, and HTTPS, causing the system to become unresponsive to management session requests.

Recommendations For Cisco Adaptive Security Appliance (ASA) Software version 9.1.3 and earlier, consider restricting access to management session requests until a fix is available. As a temporary workaround, limit the number of concurrent management sessions to minimize the risk of exploitation. Avoid using the affected connection-manager implementation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2013-6707

Affected Products

Cisco Asa

References · 9

• http://tools.cisco.com/security/center/viewAlert.x?alertId=32065 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6707 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131206-CVE-2013-6707 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-6707 · Vendor Advisory
• http://osvdb.org/100682 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89442 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6707 · Note
• http://securityfocus.com/bid/64148 · Note
• http://securitytracker.com/id/1029441 · Note