|Number of vulnerabilities||1|
|CVE ID|| CVE-2016-6366
|CWE ID|| CWE-119
|Public exploit||This vulnerability is being exploited in the wild.|
Cisco ASA 5500 Subscribe
Cisco ASA 5580
Cisco Catalyst 6500 Series ASA Services Module
Cisco ASA 5500-X Series
Cisco ASA 1000V Cloud Firewall
Cisco ASA Series
|Vendor||Cisco Systems, Inc|
This security advisory describes one critical risk vulnerability.
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when handling SNMP packets. A remote attacker with knowledge of SNMP community string can cause buffer overflow and cause the target device to reload or execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in full compromise of affected system.
The following models of CISCO ASA appliances are affected:
Note: this is a zero-day vulnerability, discovered after security breach of The Equation Group. The exploit code for this vulnerability was publicly exposed and is referred as EXTRABACON Exploit.Mitigation
Install patches from vendor's website.
Cisco ASA 5500: 7.2(5), 8.0(5), 8.2(x), 8.3(x), 8.4(x)
Cisco ASA 5580: 8.1(2)
Cisco Catalyst 6500 Series ASA Services Module: -
Cisco ASA 5500-X Series: 8.6(x)
Cisco ASA 1000V Cloud Firewall : 8.7(1)
Cisco ASA Series: 9.0(x), 9.1(x), 9.2(x), 9.3(x), 9.4(x), 9.5(x), 9.6(x)CPE
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.