PT-2016-4752 · Cisco · Cisco Asa

Published 2016-05-17 · Updated 2023-08-15 · CVE-2016-1385

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software versions through 9.5.2

Description The issue concerns the XML parser in the software, allowing remote authenticated users to cause a denial of service, which may result in instability, memory consumption, or device reload. This can be achieved by providing a crafted XML document, either through administrative access or Clientless SSL VPN access.

Recommendations For versions through 9.5.2, consider restricting access to the XML parser functionality until a fix is available. As a temporary workaround, limit administrative and Clientless SSL VPN access to trusted users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-399

CWE-119

Related Identifiers

CVE-2016-1385

Affected Products

Cisco Asa

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160517-asa-xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1385 · Security Note
• http://securitytracker.com/id/1035976 · Note