PT-2017-2272 · Cisco · Cisco Asa

Published 2017-02-08 · Updated 2023-08-15 · CVE-2017-3807

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco ASA Software versions 9.0 through 9.6

Description The issue is caused by insufficient validation of user-supplied input and a heap overflow in the Common Internet Filesystem (CIFS) code of the Clientless SSL VPN functionality. This could allow a remote attacker to cause a system reload or potentially execute code by sending a crafted URL to the affected system. The attack requires a valid TCP connection and can be triggered by IPv4 or IPv6 traffic. The attacker must have valid credentials to log in to the Clientless SSL VPN portal.

Recommendations For Cisco ASA Software versions 9.0 through 9.6, update to a fixed version to resolve the issue. As a temporary workaround, consider restricting access to the Clientless SSL VPN portal and limiting the use of CIFS code to minimize the risk of exploitation. Ensure that only necessary and trusted users have access to the portal, and monitor system logs for suspicious activity.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-01470

CVE-2017-3807

Affected Products

Cisco Asa

References · 8

• 🔥 https://exploit-db.com/exploits/41369 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-3807 · Security Note
• https://bdu.fstec.ru/vul/2017-01470 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170208-asa · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-3807 · Vendor Advisory
• http://securityfocus.com/bid/96161 · Note
• https://t.me/cvenotify/56313 · Telegram Post
• http://securitytracker.com/id/1037797 · Note