Details of VAR-201506-0188

ID

VAR-201506-0188

CVE

CVE-2015-4550

TITLE

Cisco Adaptive Security Appliance Device software Cavium In the cryptographic module firmware IPSec and IKEv2 Vulnerabilities spoofed by traffic

Trust: 0.8

sources: JVNDB: JVNDB-2015-003190

DESCRIPTION

The Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with software 9.3(3) and 9.4(1.1) does not verify the AES-GCM Integrity Check Value (ICV) octets, which makes it easier for man-in-the-middle attackers to spoof IPSec and IKEv2 traffic by modifying packet data, aka Bug ID CSCuu66218. An attacker can exploit this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. This issue is tracked by Cisco Bug ID CSCuu66218

Trust: 1.98

sources: NVD: CVE-2015-4550 // JVNDB: JVNDB-2015-003190 // BID: 75269 // VULHUB: VHN-82511

AFFECTED PRODUCTS

vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.4\(1.1\)	Trust: 1.6
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.3\(3\)	Trust: 1.6
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.4(1.1)	Trust: 1.1
vendor:	cisco	model:	adaptive security appliance	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.3(3)	Trust: 0.8
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.3.3	Trust: 0.3

sources: BID: 75269 // JVNDB: JVNDB-2015-003190 // CNNVD: CNNVD-201506-318 // NVD: CVE-2015-4550

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-4550
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2015-4550
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201506-318
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-82511
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2015-4550
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-82511
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-82511 // JVNDB: JVNDB-2015-003190 // CNNVD: CNNVD-201506-318 // NVD: CVE-2015-4550

PROBLEMTYPE DATA

problemtype:

CWE-310

Trust: 1.9

sources: VULHUB: VHN-82511 // JVNDB: JVNDB-2015-003190 // NVD: CVE-2015-4550

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201506-318

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201506-318

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-003190

PATCH

title:

39366

url:

http://tools.cisco.com/security/center/viewAlert.x?alertId=39366

Trust: 0.8

sources: JVNDB: JVNDB-2015-003190

EXTERNAL IDS

db:	NVD	id:	CVE-2015-4550	Trust: 2.8
db:	BID	id:	75269	Trust: 1.4
db:	SECTRACK	id:	1032595	Trust: 1.1
db:	JVNDB	id:	JVNDB-2015-003190	Trust: 0.8
db:	CNNVD	id:	CNNVD-201506-318	Trust: 0.7
db:	VULHUB	id:	VHN-82511	Trust: 0.1

sources: VULHUB: VHN-82511 // BID: 75269 // JVNDB: JVNDB-2015-003190 // CNNVD: CNNVD-201506-318 // NVD: CVE-2015-4550

REFERENCES

url:	http://tools.cisco.com/security/center/viewalert.x?alertid=39366	Trust: 2.0
url:	http://www.securityfocus.com/bid/75269	Trust: 1.1
url:	http://www.securitytracker.com/id/1032595	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-4550	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-4550	Trust: 0.8
url:	http://www.cisco.com/en/us/products/ps12726/index.html	Trust: 0.3
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-82511 // BID: 75269 // JVNDB: JVNDB-2015-003190 // CNNVD: CNNVD-201506-318 // NVD: CVE-2015-4550

CREDITS

Cisco

Trust: 0.3

sources: BID: 75269

SOURCES

db:	VULHUB	id:	VHN-82511
db:	BID	id:	75269
db:	JVNDB	id:	JVNDB-2015-003190
db:	CNNVD	id:	CNNVD-201506-318
db:	NVD	id:	CVE-2015-4550

LAST UPDATE DATE

2024-11-23T21:54:57.841000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-82511	date:	2016-12-07T00:00:00
db:	BID	id:	75269	date:	2015-06-16T00:00:00
db:	JVNDB	id:	JVNDB-2015-003190	date:	2015-06-19T00:00:00
db:	CNNVD	id:	CNNVD-201506-318	date:	2015-06-18T00:00:00
db:	NVD	id:	CVE-2015-4550	date:	2024-11-21T02:31:19.303

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-82511	date:	2015-06-17T00:00:00
db:	BID	id:	75269	date:	2015-06-16T00:00:00
db:	JVNDB	id:	JVNDB-2015-003190	date:	2015-06-19T00:00:00
db:	CNNVD	id:	CNNVD-201506-318	date:	2015-06-18T00:00:00
db:	NVD	id:	CVE-2015-4550	date:	2015-06-17T10:59:07.727