cnvd-2018-09396
Vulnerability from cnvd
Title
Cisco Adaptive Security Appliance Software和Firepower Threat Defense Software Transport Layer Security库输入验证漏洞
Description
Cisco Adaptive Security Virtual Appliance等都是美国思科（Cisco）公司的安全设备。Adaptive Security Appliance（ASA）Software和Firepower Threat Defense（FTD）Software都是运行在不同安全设备中的操作系统。Transport Layer Security（TLS）是其中的一个传输层安全协议库。 多款Cisco产品中的ASA Software和FTD Software中的TLS库存在输入验证漏洞，该漏洞源于程序未能充分的校验用户提交的输入。远程攻击者可通过向界面发送恶意的TLS消息利用该漏洞造成拒绝服务（崩溃）。
Severity
高
Patch Name
Cisco Adaptive Security Appliance Software和Firepower Threat Defense Software Transport Layer Security库输入验证漏洞的补丁
Patch Description
Cisco Adaptive Security Virtual Appliance等都是美国思科（Cisco）公司的安全设备。Adaptive Security Appliance（ASA）Software和Firepower Threat Defense（FTD）Software都是运行在不同安全设备中的操作系统。Transport Layer Security（TLS）是其中的一个传输层安全协议库。 多款Cisco产品中的ASA Software和FTD Software中的TLS库存在输入验证漏洞，该漏洞源于程序未能充分的校验用户提交的输入。远程攻击者可通过向界面发送恶意的TLS消息利用该漏洞造成拒绝服务（崩溃）。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3

Reference
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3
Impacted products
Name
['Cisco Adaptive Security Virtual Appliance (ASAv)', 'Cisco Firepower 2100 Series Security Appliance', 'Cisco Firepower Threat Defense Virtual (FTDv)']
Show details on source website

To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-0231",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0231"
    }
  },
  "description": "Cisco Adaptive Security Virtual Appliance\u7b49\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u5b89\u5168\u8bbe\u5907\u3002Adaptive Security Appliance\uff08ASA\uff09Software\u548cFirepower Threat Defense\uff08FTD\uff09Software\u90fd\u662f\u8fd0\u884c\u5728\u4e0d\u540c\u5b89\u5168\u8bbe\u5907\u4e2d\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002Transport Layer Security\uff08TLS\uff09\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u4f20\u8f93\u5c42\u5b89\u5168\u534f\u8bae\u5e93\u3002\r\n\r\n\u591a\u6b3eCisco\u4ea7\u54c1\u4e2d\u7684ASA Software\u548cFTD Software\u4e2d\u7684TLS\u5e93\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u7684\u6821\u9a8c\u7528\u6237\u63d0\u4ea4\u7684\u8f93\u5165\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5411\u754c\u9762\u53d1\u9001\u6076\u610f\u7684TLS\u6d88\u606f\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u5d29\u6e83\uff09\u3002",
  "discovererName": "Unknow",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-09396",
  "openTime": "2018-05-14",
  "patchDescription": "Cisco Adaptive Security Virtual Appliance\u7b49\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u5b89\u5168\u8bbe\u5907\u3002Adaptive Security Appliance\uff08ASA\uff09Software\u548cFirepower Threat Defense\uff08FTD\uff09Software\u90fd\u662f\u8fd0\u884c\u5728\u4e0d\u540c\u5b89\u5168\u8bbe\u5907\u4e2d\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002Transport Layer Security\uff08TLS\uff09\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u4f20\u8f93\u5c42\u5b89\u5168\u534f\u8bae\u5e93\u3002\r\n\r\n\u591a\u6b3eCisco\u4ea7\u54c1\u4e2d\u7684ASA Software\u548cFTD Software\u4e2d\u7684TLS\u5e93\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u7684\u6821\u9a8c\u7528\u6237\u63d0\u4ea4\u7684\u8f93\u5165\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5411\u754c\u9762\u53d1\u9001\u6076\u610f\u7684TLS\u6d88\u606f\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08\u5d29\u6e83\uff09\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Adaptive Security Appliance Software\u548cFirepower Threat Defense Software Transport Layer Security\u5e93\u8f93\u5165\u9a8c\u8bc1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Cisco Adaptive Security Virtual Appliance (ASAv)",
      "Cisco Firepower 2100 Series Security Appliance",
      "Cisco Firepower Threat Defense Virtual (FTDv)"
    ]
  },
  "referenceLink": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3",
  "serverity": "\u9ad8",
  "submitTime": "2018-05-10",
  "title": "Cisco Adaptive Security Appliance Software\u548cFirepower Threat Defense Software Transport Layer Security\u5e93\u8f93\u5165\u9a8c\u8bc1\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.