PT-2020-4459 · Cisco · Cisco Asa+1

Published 2020-10-21 · Updated 2023-08-16 · CVE-2020-3436

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A vulnerability in the web services interface could allow an unauthenticated, remote attacker to upload arbitrary-sized files to specific folders on an affected device, leading to an unexpected device reload. The issue exists due to the software's inability to efficiently handle the writing of large files to specific folders on the local file system. An attacker could exploit this by uploading files to those folders, potentially causing a denial of service (DoS) condition by triggering a watchdog timeout.

Recommendations For Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) Software, consider restricting access to the web services interface as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2020-05007

CVE-2020-3436

Affected Products

Cisco Asa

Cisco Ftd

References · 6

• https://osv.dev/vulnerability/CVE-2020-3436 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05007 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/658694 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-fileup-dos-zvC7wtys · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-fileup-dos-zvC7wtys · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3436 · Security Note