Out-of-bounds read in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) - CVE-2020-3298
Published: May 7, 2020
Vulnerability identifier: #VU27600
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3298
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in the Open Shortest Path First (OSPF) implementation. A remote attacker can send specially crafted OSPF packets in a short period of time, trigger out-of-bounds read error and cause a denial of service condition on the target system.
Affected software
Cisco Secure Firewall Adaptive Security Appliance (ASA)
Cisco Secure Firewall Threat Defense (FTD)
Cisco Secure Firewall Threat Defense (FTD)
How to mitigate CVE-2020-3298
Vendor recommends to update the Cisco FTD Software Release to version 6.2.3.16 (June 2020), 6.3.0.6 (future release), 6.4.0.9 (May 2020) and 6.5.0.5 (future release).
Cisco Secure Firewall Adaptive Security Appliance (ASA) - addressed in versions 9.6.4.40, 9.8.4.17, 9.9.2.66, 9.10.1.37, 9.12.3.7, 9.13.1.7