Executive Summary

Summary
Title Cisco ASA Software DNS Denial of Service Vulnerability
Informations
Name cisco-sa-20170419-asa-dns First vendor Publication 2017-04-19
Vendor Cisco Last vendor Modification 2017-04-19
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:P)
Cvss Base Score 5.8 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the information present in the device's local DNS cache.

The vulnerability is due to a flaw in handling crafted DNS response messages. An attacker could exploit this vulnerability by triggering a DNS request from the Cisco ASA Software and replying with a crafted response. A successful exploit could cause the device to reload, resulting in a denial of service (DoS) condition or corruption of the local DNS cache information.

Note: Only traffic directed to the affected device can be used to exploit this vulnerability. This vulnerability affects Cisco ASA Software configured in routed or transparent firewall mode and single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-asa-dns ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-asa-dns"]

BEGIN PGP SIGNATURE

iQKBBAEBAgBrBQJY94zJZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHm2XBAArriQMW1B59VSOUHr rJR/+aAlpJ+hSIHF7UgSazutEELZ9sn7gXkCrGEYh3EV5WtUDju1xETuQPwH/Esy 4A5FQJnNCWHjRlC/3CyunpvLCZNm8x0353FQRHB7KwMBQ9sbM+0onvlyspBHYH8U IGPin4VmAWvoIvFqB3Lezm7+zeBuJn9v/PAWO3sbZTxkcAjJIU/Tjykt0pre4qa9 ntz7Xgv64dRCsNM1BfeK+I504ffGuogvrC33KH6chxXasZesvCsnSQLgs6K+7XGq pkGPcCuQk3te6GqBLNlTs0jPXkfbD5OFb3K1mPP8VZEelIKCKO79iaafPpb5daiD JyMqJqJQM5WPm+FUTS9PnHME8wmvc9Lb5IuBVfbMXnfYmO20Ax3vE+htrop2rg0p Cy81nAoSi5wrKx6c8ZR5CPGXfKW1B+2WWIBErTJQvENhUVg719Q42gDJ+XD09qZ8 W2fNBcmkUQ8KTl5uO7RyyNEpONJ/A+6vGV7NOY9euG0yxq6GiDlrWitECb7wiYcu MvcPjFF9i1KDNhR/9dTOR/R7dLj4iH+5tIQo1smXbRPQVqbhUrFW+kKJTFzRoRte QYlT982veljAAWyL6U5tX7Pg+sSEiEU3/E4Qq9OoR+nGQRqZRDhxNGvSIBmhCQtl ByXe+cCCOmiaiCtJ9VMOXk2pFsE= =7thT END PGP SIGNATURE

_______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com

Original Source

Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...)

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 109

Nessus® Vulnerability Scanner

Date Description
2017-04-25 Name : The remote device is missing a vendor-supplied security patch.
File : cisco-sa-20170419-asa-dns.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
Date Informations
2017-04-27 00:24:28
  • Multiple Updates
2017-04-26 13:20:57
  • Multiple Updates
2017-04-21 05:24:01
  • Multiple Updates
2017-04-20 17:23:02
  • First insertion