Denial of service in Cisco Adaptive Security Appliance (ASA) - CVE-2016-6431

Vulnerability identifier: #VU1046

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6431

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulneability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is due to insufficient input validation. By sending a specially crafted enrollment request to the target system via HTTPS, attackers can trigger flaw in the Certificate Authority (CA) enrollment feature that leads to the system reload.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Cisco Adaptive Security Appliance (ASA)
openEuler
httpd
httpd-debuginfo
httpd-debugsource
httpd-devel
httpd-tools
mod_ldap
mod_md
mod_proxy_html
mod_session
mod_ssl
httpd-filesystem
httpd-help

Update to version 9.0(4.42), 9.1(7.7), 9.2(4.13), 9.3(3.11), 9.4(3.6), 9.5(3) or 9.6(1.5).

httpd - update to 2.4.51-22
httpd-debuginfo - update to 2.4.51-22
httpd-debugsource - update to 2.4.51-22
httpd-devel - update to 2.4.51-22
httpd-tools - update to 2.4.51-22
mod_ldap - update to 2.4.51-22
mod_md - update to 2.4.51-22
mod_proxy_html - update to 2.4.51-22
mod_session - update to 2.4.51-22
mod_ssl - update to 2.4.51-22
httpd-filesystem - update to 2.4.51-22
httpd-help - update to 2.4.51-22

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-asa-ca

• Denial of service in Cisco ASA
• openEuler update for httpd