Details of VAR-201810-0573

ID

VAR-201810-0573

CVE

CVE-2018-15383

TITLE

Cisco Adaptive Security Appliance and Firepower Threat Defense Software depletion vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-013333

DESCRIPTION

A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the affected devices have a limited amount of Direct Memory Access (DMA) memory and the affected software improperly handles resources in low-memory conditions. An attacker could exploit this vulnerability by sending a sustained, high rate of malicious traffic to an affected device to exhaust memory on the device. A successful exploit could allow the attacker to exhaust DMA memory on the affected device, which could cause the device to reload and result in a temporary DoS condition. CiscoASA5506-XwithFirePOWERServices are all different series of security devices from Cisco. Both AdaptiveSecurityAppliance(ASA)Software and FirepowerThreatDefense(FTD)Software are used in the operating system. Cisco ASA 5506-X with FirePOWER Services, etc. The following products are affected: Cisco ASA 5506-X with FirePOWER Services; ASA 5506H-X with FirePOWER Services; ASA 5506W-X with FirePOWER Services; ASA 5508-X with FirePOWER Services; ASA 5516-X with FirePOWER Services

Trust: 2.25

sources: NVD: CVE-2018-15383 // JVNDB: JVNDB-2018-013333 // CNVD: CNVD-2018-21927 // VULHUB: VHN-125637

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-21927

AFFECTED PRODUCTS

vendor:	cisco	model:	firepower threat defense	scope:	eq	version:	6.2.3	Trust: 1.6
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.8	Trust: 1.6
vendor:	cisco	model:	firepower threat defense	scope:	eq	version:	6.0.1	Trust: 1.6
vendor:	cisco	model:	firepower threat defense	scope:	eq	version:	6.2.0	Trust: 1.6
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.9\(28\)	Trust: 1.6
vendor:	cisco	model:	firepower threat defense	scope:	eq	version:	6.0	Trust: 1.6
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.9	Trust: 1.6
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.7	Trust: 1.6
vendor:	cisco	model:	firepower threat defense	scope:	eq	version:	6.1.0	Trust: 1.6
vendor:	cisco	model:	firepower threat defense	scope:	eq	version:	6.2.2	Trust: 1.6
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.6	Trust: 1.0
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.3	Trust: 1.0
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.4	Trust: 1.0
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.5	Trust: 1.0
vendor:	cisco	model:	adaptive security appliance software	scope:	eq	version:	9.6\(43\)	Trust: 1.0
vendor:	cisco	model:	adaptive security appliance software	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	firepower threat defense software	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	asa with firepower services	scope:	eq	version:	5506-x	Trust: 0.6
vendor:	cisco	model:	asa 5506h-x with firepower services	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	asa 5506w-x with firepower services	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	asa with firepower services	scope:	eq	version:	5508-x	Trust: 0.6
vendor:	cisco	model:	asa with firepower services	scope:	eq	version:	5516-x	Trust: 0.6

sources: CNVD: CNVD-2018-21927 // JVNDB: JVNDB-2018-013333 // CNNVD: CNNVD-201810-181 // NVD: CVE-2018-15383

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-15383
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-15383
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2018-21927
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201810-181
value:	HIGH
Trust: 0.6
VULHUB:	VHN-125637
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-15383
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-21927
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-125637
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-15383
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2018-15383
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2018-21927 // VULHUB: VHN-125637 // JVNDB: JVNDB-2018-013333 // CNNVD: CNNVD-201810-181 // NVD: CVE-2018-15383

PROBLEMTYPE DATA

problemtype:	CWE-400	Trust: 1.9
problemtype:	CWE-770	Trust: 1.1

sources: VULHUB: VHN-125637 // JVNDB: JVNDB-2018-013333 // NVD: CVE-2018-15383

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201810-181

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201810-181

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-013333

PATCH

title:	cisco-sa-20181003-asa-dma-dos	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-asa-dma-dos	Trust: 0.8
title:	Patch for CiscoAdaptiveSecurityApplianceSoftware and FirepowerThreatDefenseSoftware Denial of Service Vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/143377	Trust: 0.6
title:	Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=85395	Trust: 0.6

sources: CNVD: CNVD-2018-21927 // JVNDB: JVNDB-2018-013333 // CNNVD: CNNVD-201810-181

EXTERNAL IDS

db:	NVD	id:	CVE-2018-15383	Trust: 3.1
db:	SECTRACK	id:	1041787	Trust: 2.3
db:	JVNDB	id:	JVNDB-2018-013333	Trust: 0.8
db:	CNNVD	id:	CNNVD-201810-181	Trust: 0.7
db:	CNVD	id:	CNVD-2018-21927	Trust: 0.6
db:	VULHUB	id:	VHN-125637	Trust: 0.1

sources: CNVD: CNVD-2018-21927 // VULHUB: VHN-125637 // JVNDB: JVNDB-2018-013333 // CNNVD: CNNVD-201810-181 // NVD: CVE-2018-15383

REFERENCES

url:	http://www.securitytracker.com/id/1041787	Trust: 2.3
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20181003-asa-dma-dos	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15383	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-15383	Trust: 0.8

sources: CNVD: CNVD-2018-21927 // VULHUB: VHN-125637 // JVNDB: JVNDB-2018-013333 // CNNVD: CNNVD-201810-181 // NVD: CVE-2018-15383

SOURCES

db:	CNVD	id:	CNVD-2018-21927
db:	VULHUB	id:	VHN-125637
db:	JVNDB	id:	JVNDB-2018-013333
db:	CNNVD	id:	CNNVD-201810-181
db:	NVD	id:	CVE-2018-15383

LAST UPDATE DATE

2024-08-14T15:18:15.006000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-21927	date:	2018-10-28T00:00:00
db:	VULHUB	id:	VHN-125637	date:	2020-08-31T00:00:00
db:	JVNDB	id:	JVNDB-2018-013333	date:	2019-02-19T00:00:00
db:	CNNVD	id:	CNNVD-201810-181	date:	2020-10-22T00:00:00
db:	NVD	id:	CVE-2018-15383	date:	2023-08-15T15:24:56.340

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-21927	date:	2018-10-28T00:00:00
db:	VULHUB	id:	VHN-125637	date:	2018-10-05T00:00:00
db:	JVNDB	id:	JVNDB-2018-013333	date:	2019-02-19T00:00:00
db:	CNNVD	id:	CNNVD-201810-181	date:	2018-10-08T00:00:00
db:	NVD	id:	CVE-2018-15383	date:	2018-10-05T14:29:07.230