Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2019-1708

Опубликовано: 03 мая 2019
Источник: nvd
CVSS3: 8.6
CVSS3: 8.6
CVSS2: 7.8
EPSS Низкий

Описание

A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming Protocol (MOBIKE) feature for the Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to the incorrect processing of certain MOBIKE packets. An attacker could exploit this vulnerability by sending crafted MOBIKE packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. The MOBIKE feature is supported only for IPv4 addresses.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
Версия от 6.2.2 (включая) до 6.2.3.12 (включая)
cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*
Версия от 6.3.0 (включая) до 6.3.0.3 (включая)
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
Версия от 9.8 (включая) до 9.8.4 (включая)
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
Версия от 9.9 (включая) до 9.9.2.50 (включая)
cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*
Версия от 9.10 (включая) до 9.10.1.17 (включая)

Одно из

cpe:2.3:h:cisco:asa-5506-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa-5525-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa-5555-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5506h-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5506w-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5508-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5516-x:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asa_5545-x:-:*:*:*:*:*:*:*

EPSS

Процентиль: 76%
0.00941
Низкий

8.6 High

CVSS3

8.6 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-404
CWE-401

Связанные уязвимости

github логотип

GHSA-hjw3-6ghp-6f5f

CVSS3: 8.6
github
больше 3 лет назад

A vulnerability in the Internet Key Exchange Version 2 Mobility and Multihoming Protocol (MOBIKE) feature for the Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service (DoS) condition. The vulnerability is due to the incorrect processing of certain MOBIKE packets. An attacker could exploit this vulnerability by sending crafted MOBIKE packets to an affected device to be processed. A successful exploit could cause an affected device to continuously consume memory and eventually reload, resulting in a DoS condition. The MOBIKE feature is supported only for IPv4 addresses.

fstec логотип

BDU:2019-01786

CVSS3: 8.6
fstec
почти 7 лет назад

Уязвимость службы обмена ключами MOBIKE микропрограммного обеспечения межсетевых экранов Cisco Adaptive Security Appliance и Cisco Firepower Threat Defense, позволяющая нарушителю вызвать утечку памяти или перезагрузку уязвимого устройства

EPSS

Процентиль: 76%
0.00941
Низкий

8.6 High

CVSS3

8.6 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-404
CWE-401