#VU1048 Buffer overflow in Cisco Adaptive Security Appliance (ASA) - CVE-2016-6432

Vulnerability identifier: #VU1048

Vulnerability risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-6432

CWE-ID: CWE-120

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco Adaptive Security Appliance (ASA)
Hardware solutions / Security hardware applicances

Vendor: Cisco Systems, Inc

Description
The vulnerability allows a remote unauthenticated user to execute arbitrary code on the target system.
The weakness is caused by improper checking of the input. By returning a specially crafted NetBIOS packet via IPv4 in response to a NetBIOS probe sent by the target system, attackers can trigger a buffer overflow that lets execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Mitigation
Update to version 9.0(4.42), 9.1(7.11), 9.2(4.17), 9.3(3.11), 9.4(3.11), 9.5(3.1), 9.6(2.1).

Vulnerable software versions

Cisco Adaptive Security Appliance (ASA): 8.4, 8.5, 8.6, 8.7, 9.0, 9.1, 9.2, 9.3, 9.4, 9.5, 9.6

---

External links
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-asa-idfw

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.