You are here

V-135: Cisco ASA Multiple Bugs Let Remote Users Deny Service

April 16, 2013 - 12:21am

Addthis

PROBLEM:

Cisco ASA Multiple Bugs Let Remote Users Deny Service

PLATFORM:

Cisco ASA Software for Cisco ASA 5500 Series Adaptive Security Appliances, Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, and Cisco ASA 1000V Cloud Firewall are affected by multiple vulnerabilities. Affected versions of Cisco ASA Software will vary depending on the specific vulnerability.

ABSTRACT:

Several vulnerabilities were reported in Cisco ASA.

REFERENCE LINKS:

Cisco Security Advisory
Secunia Advisory SA52989
SecurityTracker Alert ID: 1028415
CVE-2013-1149
CVE-2013-1150
CVE-2013-1151
CVE-2013-1152 

IMPACT ASSESSMENT:

Medium

DISCUSSION:

 A remote user can send a specially crafted IKEv1 message to the target system to cause the target device to reload [CVE-2013-1149].

A remote user can send a specially crafted URL to or through the target device to trigger a flaw in the authentication proxy feature and cause the target device to reload [CVE-2013-1150].

A remote user can send a specially crafted certificate to the target device to trigger an implementation error in the validation code and cause the target system to reload [CVE-2013-1151].

A remote user can send a specially crafted DNS message through the target device to trigger a DNS inspection error and cause the target device to reload [CVE-2013-1152].

IMPACT:

A remote user can cause denial of service conditions.

SOLUTION:

The vendor has issued a fix

Addthis