PT-2019-2041 · Cisco · Cisco Asa+1

Published 2019-05-01 · Updated 2023-08-15 · CVE-2019-1708

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming Protocol (MOBIKE) feature could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device, leading to a denial of service (DoS) condition. The vulnerability is due to the incorrect processing of certain MOBIKE packets. An attacker could exploit this vulnerability by sending crafted MOBIKE packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. The MOBIKE feature is supported only for IPv4 addresses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Leak

Improper Resource Release

Weakness Enumeration

CWE-401

CWE-404

Related Identifiers

BDU:2019-01786

CVE-2019-1708

Affected Products

Cisco Asa

Cisco Ftd

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-ike-dos · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1708 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1708 · Security Note
• https://bdu.fstec.ru/vul/2019-01786 · Security Note
• https://t.me/cvenotify/56507 · Telegram Post
• http://securityfocus.com/bid/108166 · Note