Sign-up

ID

VAR-201504-0292


CVE

CVE-2015-0677


TITLE

Cisco Adaptive Security Appliance Software XML Service disruption in parsers (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2015-002210

DESCRIPTION

The XML parser in Cisco Adaptive Security Appliance (ASA) Software 8.4 before 8.4(7.28), 8.6 before 8.6(1.17), 9.0 before 9.0(4.33), 9.1 before 9.1(6), 9.2 before 9.2(3.4), and 9.3 before 9.3(3), when Clientless SSL VPN, AnyConnect SSL VPN, or AnyConnect IKEv2 VPN is used, allows remote attackers to cause a denial of service (VPN outage or device reload) via a crafted XML document, aka Bug ID CSCus95290. Vendors have confirmed this vulnerability Bug ID CSCus95290 It is released as.Skillfully crafted by a third party XML Service disruption through documentation (VPN Stop or device reload ) There is a possibility of being put into a state. Cisco Adaptive Security Appliance (ASA) Software is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to crash the WebVPN component, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCus95290. The following releases are affected: Cisco ASA Software 8.4 prior to 7.28, 8.6 prior to 8.6(1.17), 9.0 prior to 9.0(4.33), 9.1 prior to 9.1(6), 9.2 prior to 9.2(3.4), 9.3( 3) Before version 9.3

Trust: 1.98

sources: NVD: CVE-2015-0677 // JVNDB: JVNDB-2015-002210 // BID: 73967 // VULHUB: VHN-78623

AFFECTED PRODUCTS

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.3

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.26

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.14

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.2.8

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.2.2

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.17

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.2.8

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.23

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.7

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.24

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.1.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.20

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.4.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.3.6

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.4.9

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.26

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.5.21

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.5.15

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.2.8

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.10

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.4.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.2.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.3.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.6

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.3.8

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.4.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.4.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.3.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.2.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.12

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.1.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.15

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.3.9

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.22

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.13

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.5.6

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.1.11

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.5.10

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.29

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.2.7

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.1.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.2.10

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.5.12

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.3.8

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1(6)

Trust: 0.8

vendor:ciscomodel:adaptive security appliancescope: - version: -

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6(1.17)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0(4.33)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2(3.4)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.1

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:8.4

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.3

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.0

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4(7.28)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3(3)

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:8.6

Trust: 0.8

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.2

Trust: 0.8

sources: JVNDB: JVNDB-2015-002210 // CNNVD: CNNVD-201504-192 // NVD: CVE-2015-0677

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-0677
value: HIGH

Trust: 1.0

NVD: CVE-2015-0677
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201504-192
value: HIGH

Trust: 0.6

VULHUB: VHN-78623
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-0677
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-78623
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-78623 // JVNDB: JVNDB-2015-002210 // CNNVD: CNNVD-201504-192 // NVD: CVE-2015-0677

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-78623 // JVNDB: JVNDB-2015-002210 // NVD: CVE-2015-0677

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201504-192

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201504-192

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-002210

PATCH
title:cisco-sa-20150408-asaurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150408-asa
Trust: 0.8
title:38185url:http://tools.cisco.com/security/center/viewAlert.x?alertId=38185
Trust: 0.8
title:cisco-sa-20150408-asaurl:http://www.cisco.com/cisco/web/support/JP/112/1128/1128963_cisco-sa-20150408-asa-j.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-002210

EXTERNAL IDS
db:NVDid:CVE-2015-0677
Trust: 2.8
db:SECTRACKid:1032045
Trust: 1.1
db:JVNDBid:JVNDB-2015-002210
Trust: 0.8
db:CNNVDid:CNNVD-201504-192
Trust: 0.7
db:BIDid:73967
Trust: 0.4
db:VULHUBid:VHN-78623
Trust: 0.1
sources:
            
            
            VULHUB: VHN-78623 // 
            
            
            
            BID: 73967 // 
            
            
            
            JVNDB: JVNDB-2015-002210 // 
            
            
            
            CNNVD: CNNVD-201504-192 // 
            
            
            
            NVD: CVE-2015-0677

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20150408-asa
Trust: 2.0
url:http://www.securitytracker.com/id/1032045
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0677
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-0677
Trust: 0.8
url:http://tools.cisco.com/security/center/viewalert.x?alertid=38185
Trust: 0.3
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-78623 // 
            
            
            
            BID: 73967 // 
            
            
            
            JVNDB: JVNDB-2015-002210 // 
            
            
            
            CNNVD: CNNVD-201504-192 // 
            
            
            
            NVD: CVE-2015-0677

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 73967

SOURCES
db:VULHUBid:VHN-78623
db:BIDid:73967
db:JVNDBid:JVNDB-2015-002210
db:CNNVDid:CNNVD-201504-192
db:NVDid:CVE-2015-0677

LAST UPDATE DATE
2024-11-23T22:08:08.018000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-78623date:2015-04-23T00:00:00
db:BIDid:73967date:2015-04-16T18:04:00
db:JVNDBid:JVNDB-2015-002210date:2015-04-15T00:00:00
db:CNNVDid:CNNVD-201504-192date:2015-04-16T00:00:00
db:NVDid:CVE-2015-0677date:2024-11-21T02:23:31.243

SOURCES RELEASE DATE
db:VULHUBid:VHN-78623date:2015-04-13T00:00:00
db:BIDid:73967date:2015-04-08T00:00:00
db:JVNDBid:JVNDB-2015-002210date:2015-04-15T00:00:00
db:CNNVDid:CNNVD-201504-192date:2015-04-14T00:00:00
db:NVDid:CVE-2015-0677date:2015-04-13T01:59:03.033