Multiple vulnerabilities in Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software



Published: 2021-10-29
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2021-34790
CVE-2021-34791
CWE-ID CWE-358
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Cisco Adaptive Security Appliance (ASA) Software
Hardware solutions / Security hardware applicances

Cisco Firepower Threat Defense (FTD)
Hardware solutions / Security hardware applicances

Vendor Cisco Systems, Inc

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improperly implemented security check for standard

EUVDB-ID: #VU57796

Risk: Medium

CVSSv3.1: 4.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34790

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient traffic validation within the Session Initiation Protocol (SIP) Application Level Gateway (ALG) for the Network Address Translation (NAT) feature. A remote attacker can send a specially crafted SIP traffic, open unauthorized connections to the remote host and undertake actions leveraging that host. 

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco Adaptive Security Appliance (ASA) Software: 9.12 - 9.8

Cisco Firepower Threat Defense (FTD): 6.2.2 - 6.7.0


CPE2.3 External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improperly implemented security check for standard

EUVDB-ID: #VU57797

Risk: Medium

CVSSv3.1: 4.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34791

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient traffic validation within the File Transfer Protocol (FTP) Application Level Gateway (ALG) for the Network Address Translation (NAT) feature. A remote attacker can send a specially crafted FTP traffic, open unauthorized connections to the remote host and undertake actions leveraging that host. 

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco Adaptive Security Appliance (ASA) Software: 9.12 - 9.8

Cisco Firepower Threat Defense (FTD): 6.2.2 - 6.7.0


CPE2.3 External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###