Sign-up

ID

VAR-201605-0548


CVE

CVE-2016-1385


TITLE

Cisco Adaptive Security Appliance Software XML Service disruption in parsers (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2016-002948

DESCRIPTION

The XML parser in Cisco Adaptive Security Appliance (ASA) Software through 9.5.2 allows remote authenticated users to cause a denial of service (instability, memory consumption, or device reload) by leveraging (1) administrative access or (2) Clientless SSL VPN access to provide a crafted XML document, aka Bug ID CSCut14209. Successful exploits may allow an attacker to reload the affected device, resulting in a denial-of-service conditions. This issue is being tracked by Cisco Bug ID CSCut14209 . The appliance also includes IPS (Intrusion Prevention System), SSL VPN, IPSec VPN, anti-spam, and more. A security vulnerability exists in the Cisco ASA's XML parser code

Trust: 1.98

sources: NVD: CVE-2016-1385 // JVNDB: JVNDB-2016-002948 // BID: 90721 // VULHUB: VHN-90204

AFFECTED PRODUCTS

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.3.4

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.3

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.5.21

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.4

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.3

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.3.2

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.2.8

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.3.3

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.1.3

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.1.11

Trust: 1.6

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.6

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3\(1.50\)

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3\(2.243\)

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.4.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.5.1.19

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.3.6

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.26

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2\(0.0\)

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.5.1.18

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.5.15

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.23

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.7.1.8

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.6.8

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.4.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.26

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.4.1.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.4.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.6

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.3.8

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.4.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.28

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.6.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.3.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.3.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.3.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.17

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.4.1.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2\(0.104\)

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.37

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.4.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.15

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.13

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.0

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.4.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2\(3.1\)

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.6.10

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.5.10

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.4.2.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.4.1.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.2.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.2.7

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.2.8

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.2.10

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.7

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.5.12

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.5.1.24

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.33

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.4.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.24

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3\(2.100\)

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.20

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.7.1.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.7.1.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.17

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.5.1.17

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.29

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.4.0.115

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.3.6

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.7.1.16

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.4.9

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.2.8

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.10

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.2.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.6.6

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.4.1.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.14

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.4.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.7.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.5.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.2.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3\(1.105\)

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.12

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.5.1.6

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.7.1.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.5.1.14

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.1.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.7.22

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.3.9

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.5.1.7

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.6.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.7.1.7

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.6.1.2

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.4.5.6

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.5.1.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.7.1.17

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.7.1.13

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.5.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.29

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4.35

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.2.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.3.1.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.7.1.11

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.5.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.3.8

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:8.5.1.21

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.1.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.0.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:lteversion:9.5.2

Trust: 0.8

sources: JVNDB: JVNDB-2016-002948 // CNNVD: CNNVD-201605-439 // NVD: CVE-2016-1385

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-1385
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-1385
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201605-439
value: MEDIUM

Trust: 0.6

VULHUB: VHN-90204
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-1385
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-90204
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-1385
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-90204 // JVNDB: JVNDB-2016-002948 // CNNVD: CNNVD-201605-439 // NVD: CVE-2016-1385

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

problemtype:CWE-399

Trust: 1.9

sources: VULHUB: VHN-90204 // JVNDB: JVNDB-2016-002948 // NVD: CVE-2016-1385

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201605-439

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201605-439

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-002948

PATCH
title:cisco-sa-20160517-asa-xmlurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160517-asa-xml
Trust: 0.8
title:Cisco Adaptive Security Appliance Remediation measures for denial of service vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=61753
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-002948 // 
            
            
            
            CNNVD: CNNVD-201605-439

EXTERNAL IDS
db:NVDid:CVE-2016-1385
Trust: 2.8
db:SECTRACKid:1035976
Trust: 1.1
db:JVNDBid:JVNDB-2016-002948
Trust: 0.8
db:CNNVDid:CNNVD-201605-439
Trust: 0.7
db:BIDid:90721
Trust: 0.3
db:VULHUBid:VHN-90204
Trust: 0.1
sources:
            
            
            VULHUB: VHN-90204 // 
            
            
            
            BID: 90721 // 
            
            
            
            JVNDB: JVNDB-2016-002948 // 
            
            
            
            CNNVD: CNNVD-201605-439 // 
            
            
            
            NVD: CVE-2016-1385

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160517-asa-xml
Trust: 1.4
url:http://www.securitytracker.com/id/1035976
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1385
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1385
Trust: 0.8
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160517-asa-xml/
Trust: 0.6
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-90204 // 
            
            
            
            BID: 90721 // 
            
            
            
            JVNDB: JVNDB-2016-002948 // 
            
            
            
            CNNVD: CNNVD-201605-439 // 
            
            
            
            NVD: CVE-2016-1385

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 90721

SOURCES
db:VULHUBid:VHN-90204
db:BIDid:90721
db:JVNDBid:JVNDB-2016-002948
db:CNNVDid:CNNVD-201605-439
db:NVDid:CVE-2016-1385

LAST UPDATE DATE
2024-11-23T21:54:36.797000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-90204date:2016-12-01T00:00:00
db:BIDid:90721date:2016-07-06T14:43:00
db:JVNDBid:JVNDB-2016-002948date:2016-05-30T00:00:00
db:CNNVDid:CNNVD-201605-439date:2016-05-27T00:00:00
db:NVDid:CVE-2016-1385date:2024-11-21T02:46:20.643

SOURCES RELEASE DATE
db:VULHUBid:VHN-90204date:2016-05-26T00:00:00
db:BIDid:90721date:2016-05-17T00:00:00
db:JVNDBid:JVNDB-2016-002948date:2016-05-30T00:00:00
db:CNNVDid:CNNVD-201605-439date:2016-05-18T00:00:00
db:NVDid:CVE-2016-1385date:2016-05-26T15:59:01.463