PT-2020-2238 · Cisco · Cisco Asa+1

Published 2020-05-05 · Updated 2024-11-26 · CVE-2020-3308

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description The issue is related to the improper verification of digital signatures for patch images in the Image Signature Verification feature. This could allow a remote attacker with administrator-level credentials to install a malicious software patch on an affected device. The attacker could exploit this by crafting an unsigned software patch to bypass signature checks and loading it on the device. A successful exploit could allow the attacker to boot a malicious software patch image.

Recommendations For Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the Image Signature Verification feature until a patch is available. Avoid loading unsigned software patches on affected devices until the issue is resolved.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2020-02154

CVE-2020-3308

Affected Products

Cisco Asa

Firepower Threat Defense

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-3308 · Security Note
• https://bdu.fstec.ru/vul/2020-02154 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sigbypass-FcvPPCeP · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3308 · Vendor Advisory
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-3308 · Note
• https://t.me/cvenotify/3602 · Telegram Post