PT-2016-3713 · Cisco · Cisco Asa

Published 2016-01-11 · Updated 2023-08-11 · CVE-2015-6423

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software versions 9.4.1 through 9.5.1

Description The issue allows remote users to bypass an intended DCERPC-only ACL by sending arbitrary network traffic. This is related to the DCERPC Inspection feature, which should only allow DCERPC traffic on TCP port 135, but due to the issue, an unauthenticated, remote attacker could send non-DCERPC traffic between hosts configured only for DCERPC inspection.

Recommendations For versions 9.4.1 through 9.5.1, consider restricting access to the DCERPC Inspection feature until a patch is available, and ensure that only DCERPC traffic is allowed on TCP port 135.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-6423

Affected Products

Cisco Asa

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160111-asa · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160111-asa · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6423 · Security Note
• http://securitytracker.com/id/1034644 · Note