PT-2017-2627 · Cisco · Cisco Asa

Published 2017-08-02 · Updated 2023-08-15 · CVE-2017-6752

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance versions 9.3(3) through 9.6(2)

Description The issue is related to a lack of protection for service data when interacting with the SSL Connection Profile via the LDAP protocol in the web interface of the Cisco Adaptive Security Appliance. This could allow a remote attacker to determine valid usernames, which could then be used for additional reconnaissance attacks. The vulnerability is due to the interaction between Lightweight Directory Access Protocol (LDAP) and SSL Connection Profile when they are configured together.

Recommendations For versions 9.3(3) and 9.6(2), consider restricting access to the LDAP protocol and SSL Connection Profile until a patch is available. As a temporary workaround, consider disabling the interaction between LDAP and SSL Connection Profile to minimize the risk of exploitation. Avoid using the vulnerable configuration that combines LDAP and SSL Connection Profile until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2017-01847

CVE-2017-6752

Affected Products

Cisco Asa

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-6752 · Security Note
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvd47888 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-asa2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6752 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01847 · Security Note
• http://securitytracker.com/id/1039057 · Note
• http://securityfocus.com/bid/100113 · Note