BDU:2022-07081

Опубликовано: 09 нояб. 2022

Источник: fstec

CVSS3: 7.7

CVSS2: 6.8

EPSS Низкий

Описание

Уязвимость реализации протоколов TLS и SSL микропрограммного обеспечения межсетевых экранов Cisco Adaptive Security Appliance (ASA) и Firepower Threat Defense (FTD) серий ASA 5500-X Series, Firepower 4100 Series и Firepower 9300 Series связана с копированием буфера без проверки размера входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Вендор

Cisco Systems Inc.

Наименование ПО

Adaptive Security Appliance

Firepower Threat Defense

Версия ПО

9.13.1.12 (Adaptive Security Appliance)

9.14.1.15 (Adaptive Security Appliance)

9.13 (Adaptive Security Appliance)

9.13.1 (Adaptive Security Appliance)

9.13.1.2 (Adaptive Security Appliance)

9.13.1.7 (Adaptive Security Appliance)

9.13.1.10 (Adaptive Security Appliance)

9.13.1.13 (Adaptive Security Appliance)

9.13.1.16 (Adaptive Security Appliance)

9.13.1.19 (Adaptive Security Appliance)

9.13.1.21 (Adaptive Security Appliance)

9.14 (Adaptive Security Appliance)

9.14.1 (Adaptive Security Appliance)

9.14.1.10 (Adaptive Security Appliance)

9.14.1.19 (Adaptive Security Appliance)

9.14.1.30 (Adaptive Security Appliance)

9.14.2 (Adaptive Security Appliance)

9.14.2.4 (Adaptive Security Appliance)

9.14.2.8 (Adaptive Security Appliance)

9.14.2.13 (Adaptive Security Appliance)

9.14.2.15 (Adaptive Security Appliance)

9.14.3 (Adaptive Security Appliance)

9.14.3.1 (Adaptive Security Appliance)

9.14.3.9 (Adaptive Security Appliance)

9.14.3.13 (Adaptive Security Appliance)

9.14.3.15 (Adaptive Security Appliance)

9.14.3.18 (Adaptive Security Appliance)

9.15 (Adaptive Security Appliance)

9.15.1 (Adaptive Security Appliance)

9.15.1.1 (Adaptive Security Appliance)

9.15.1.7 (Adaptive Security Appliance)

9.15.1.10 (Adaptive Security Appliance)

от 9.15.1.15 до 9.15.1.17 включительно (Adaptive Security Appliance)

9.15.1.21 (Adaptive Security Appliance)

6.6.0 (Adaptive Security Appliance)

6.6.0.1 (Adaptive Security Appliance)

6.6.1 (Adaptive Security Appliance)

6.6.3 (Adaptive Security Appliance)

6.6.4 (Adaptive Security Appliance)

6.6.5 (Adaptive Security Appliance)

6.6.5.1 (Adaptive Security Appliance)

6.6.5.2 (Adaptive Security Appliance)

от 6.5.0 до 6.5.0.5 включительно (Adaptive Security Appliance)

от 6.7.0 до 6.7.0.3 включительно (Adaptive Security Appliance)

от 6.7.0 до 6.7.0.3 включительно (Firepower Threat Defense)

от 6.5.0 до 6.5.0.5 включительно (Firepower Threat Defense)

9.13 (Firepower Threat Defense)

9.13.1 (Firepower Threat Defense)

9.13.1.2 (Firepower Threat Defense)

9.13.1.7 (Firepower Threat Defense)

9.13.1.10 (Firepower Threat Defense)

9.13.1.12 (Firepower Threat Defense)

9.13.1.13 (Firepower Threat Defense)

9.13.1.16 (Firepower Threat Defense)

9.13.1.19 (Firepower Threat Defense)

9.13.1.21 (Firepower Threat Defense)

9.15.1.21 (Firepower Threat Defense)

9.14.0 (Firepower Threat Defense)

9.14.1 (Firepower Threat Defense)

9.14.1.10 (Firepower Threat Defense)

9.14.1.15 (Firepower Threat Defense)

9.14.1.19 (Firepower Threat Defense)

9.14.1.30 (Firepower Threat Defense)

9.14.2 (Firepower Threat Defense)

9.14.2.4 (Firepower Threat Defense)

9.14.2.8 (Firepower Threat Defense)

9.14.2.13 (Firepower Threat Defense)

9.14.2.15 (Firepower Threat Defense)

от 9.15.1.15 до 9.15.1.17 включительно (Firepower Threat Defense)

9.14.3 (Firepower Threat Defense)

9.14.3.1 (Firepower Threat Defense)

9.14.3.9 (Firepower Threat Defense)

9.14.3.13 (Firepower Threat Defense)

9.14.3.15 (Firepower Threat Defense)

9.14.3.18 (Firepower Threat Defense)

6.6.0 (Firepower Threat Defense)

6.6.0.1 (Firepower Threat Defense)

6.6.1 (Firepower Threat Defense)

6.6.3 (Firepower Threat Defense)

6.6.4 (Firepower Threat Defense)

6.6.5 (Firepower Threat Defense)

6.6.5.1 (Firepower Threat Defense)

6.6.5.2 (Firepower Threat Defense)

9.15 (Firepower Threat Defense)

9.15.1 (Firepower Threat Defense)

9.15.1.1 (Firepower Threat Defense)

9.15.1.7 (Firepower Threat Defense)

9.15.1.10 (Firepower Threat Defense)

Тип ПО

ПО сетевого программно-аппаратного средства

ПО программно-аппаратного средства

Операционные системы и аппаратные платформы

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 6,8)

Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 7,7)

Возможные меры по устранению уязвимости

Использование рекомендаций:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssl-client-dos-cCrQPkA

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Ссылки на источники

Идентификаторы других систем описаний уязвимостей

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-20927
CVE

EPSS

Процентиль: 41%

0.00194

Низкий

7.7 High

CVSS3

6.8 Medium

CVSS2

Связанные уязвимости

CVE-2022-20927

CVSS3: 7.7

nvd

около 3 лет назад

A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when a device initiates SSL/TLS connections. An attacker could exploit this vulnerability by ensuring that the device will connect to an SSL/TLS server that is using specific encryption parameters. A successful exploit could allow the attacker to cause the affected device to unexpectedly reload, resulting in a DoS condition.

GHSA-4g76-357g-vr49

CVSS3: 6.5

github

около 3 лет назад

EPSS

Процентиль: 41%

0.00194

Низкий

7.7 High

CVSS3

6.8 Medium

CVSS2