PT-2020-4463 · Cisco · Cisco Ftd+1

Published 2020-10-21 · Updated 2023-08-16 · CVE-2020-3529

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance (ASA) Software (affected versions not specified) Cisco Firepower Threat Defense (FTD) Software (affected versions not specified)

Description A vulnerability in the SSL VPN negotiation process could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The issue is due to inefficient direct memory access (DMA) memory management during the negotiation phase of an SSL VPN connection. An attacker could exploit this by sending crafted Datagram TLS (DTLS) traffic to an affected device, potentially exhausting DMA memory and causing a DoS condition.

Recommendations For Cisco Adaptive Security Appliance (ASA) Software, update to a version that includes the fix for this issue. For Cisco Firepower Threat Defense (FTD) Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the SSL VPN negotiation process to minimize the risk of exploitation.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2020-05011

CVE-2020-3529

Affected Products

Cisco Asa

Cisco Ftd

References · 6

• https://safe-surf.ru/specialists/bulletins-nkcki/658694 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3529 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-sslvpndma-dos-HRrqB9Yx · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05011 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3529 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-sslvpndma-dos-HRrqB9Yx · Vendor Advisory