Improper input validation in Cisco Systems, Inc products - CVE-2017-12246
Published: October 5, 2017
Vulnerability identifier: #VU8700
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12246
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists in the implementation of the direct authentication feature in Cisco Adaptive Security Appliance (ASA) Software due to incomplete input validation of the HTTP header. A remote attacker send a specially crafted HTTP request to the local IP address and cause the affected device to reload. Successful exploitation of the vulnerability is trggerred by IPv4 or IPv6 traffic.
The weakness exists in the implementation of the direct authentication feature in Cisco Adaptive Security Appliance (ASA) Software due to incomplete input validation of the HTTP header. A remote attacker send a specially crafted HTTP request to the local IP address and cause the affected device to reload. Successful exploitation of the vulnerability is trggerred by IPv4 or IPv6 traffic.
Affected software
Cisco Adaptive Security Appliance (ASA)
Cisco ASA 5500
Cisco ASA 5580
Cisco ASA 5500-X Series
Cisco ASA 5500
Cisco ASA 5580
Cisco ASA 5500-X Series
How to mitigate CVE-2017-12246
The vulnerability is addressed in the following versions: 10.0.13(0.161), 10.0.11(0.77), 10.0.8(40.131), 9.9.1(20.21), 9.9.1(10.4), 9.8.1(12.59), 9.8.1(1.118), 9.8.1(0.11), 9.7.1(0.155), 9.6.2(0.135), 9.8(0.99), 9.7(1.5), 9.6(3), 9.6(2.104), 9.6(2.23), 9.5(3.7), 9.4(4.190), 9.4(4.6), 9.2(4.19), 9.1(7.17).