SB2017100503 - Two vulnerabilities in Cisco ASA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017100503

SB2017100503 - Two vulnerabilities in Cisco ASA

Published: October 5, 2017

Security Bulletin ID SB2017100503
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2017-12246)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the implementation of the direct authentication feature in Cisco Adaptive Security Appliance (ASA) Software due to incomplete input validation of the HTTP header. A remote attacker send a specially crafted HTTP request to the local IP address and cause the affected device to reload. Successful exploitation of the vulnerability is trggerred by IPv4 or IPv6 traffic.

2) Cross-site scripting (CVE-ID: CVE-2017-12265)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


Remediation

Install update from vendor's website.

References