Sign-up

ID

VAR-201908-0539


CVE

CVE-2019-1944


TITLE

Cisco Adaptive Security Appliance Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2019-007652

DESCRIPTION

Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate privileges to the root user or load a malicious library file while the tunnel is being established. For more information about these vulnerabilities, see the Details section of this security advisory. Cisco Adaptive Security Appliance (ASA) Contains an information disclosure vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Cisco Adaptive Security Appliances Software (ASA Software) is a set of firewall and network security platform of American Cisco (Cisco). The platform provides features such as highly secure access to data and network resources. The smart tunnel function in Cisco ASA has an input validation error vulnerability. The vulnerability is caused by the loose permissions assigned to the local system files created by the ASA smart tunnel on the client device. A local attacker could exploit this vulnerability by running a malicious script to elevate privileges to root without the user's knowledge

Trust: 1.8

sources: NVD: CVE-2019-1944 // JVNDB: JVNDB-2019-007652 // VULHUB: VHN-151886 // VULMON: CVE-2019-1944

AFFECTED PRODUCTS

vendor:ciscomodel:adaptive security appliance softwarescope:ltversion:9.4.4.37

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2019-007652 // NVD: CVE-2019-1944

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-1944
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2019-1944
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-1944
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201908-545
value: HIGH

Trust: 0.6

VULHUB: VHN-151886
value: MEDIUM

Trust: 0.1

VULMON: CVE-2019-1944
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-1944
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-151886
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-1944
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.3
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2019-1944
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.0

Trust: 1.0

NVD: CVE-2019-1944
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-151886 // VULMON: CVE-2019-1944 // JVNDB: JVNDB-2019-007652 // CNNVD: CNNVD-201908-545 // NVD: CVE-2019-1944 // NVD: CVE-2019-1944

PROBLEMTYPE DATA

problemtype:CWE-732

Trust: 1.1

problemtype:CWE-20

Trust: 1.0

problemtype:CWE-200

Trust: 0.9

sources: VULHUB: VHN-151886 // JVNDB: JVNDB-2019-007652 // NVD: CVE-2019-1944

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201908-545

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201908-545

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-007652

PATCH
title:cisco-sa-20190807-asa-multiurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-asa-multi
Trust: 0.8
title:Cisco Adaptive Security Appliances Software Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=96242
Trust: 0.6
title:Cisco: Cisco Adaptive Security Appliance Smart Tunnel Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20190807-asa-multi
Trust: 0.1
sources:
            
            
            VULMON: CVE-2019-1944 // 
            
            
            
            JVNDB: JVNDB-2019-007652 // 
            
            
            
            CNNVD: CNNVD-201908-545

EXTERNAL IDS
db:NVDid:CVE-2019-1944
Trust: 2.6
db:JVNDBid:JVNDB-2019-007652
Trust: 0.8
db:CNNVDid:CNNVD-201908-545
Trust: 0.7
db:AUSCERTid:ESB-2019.2988
Trust: 0.6
db:VULHUBid:VHN-151886
Trust: 0.1
db:VULMONid:CVE-2019-1944
Trust: 0.1
sources:
            
            
            VULHUB: VHN-151886 // 
            
            
            
            VULMON: CVE-2019-1944 // 
            
            
            
            JVNDB: JVNDB-2019-007652 // 
            
            
            
            CNNVD: CNNVD-201908-545 // 
            
            
            
            NVD: CVE-2019-1944

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190807-asa-multi
Trust: 1.9
url:https://nvd.nist.gov/vuln/detail/cve-2019-1944
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1944
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2019.2988/
Trust: 0.6
url:https://vigilance.fr/vulnerability/cisco-asa-privilege-escalation-via-smart-tunnel-29977
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/732.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULHUB: VHN-151886 // 
            
            
            
            VULMON: CVE-2019-1944 // 
            
            
            
            JVNDB: JVNDB-2019-007652 // 
            
            
            
            CNNVD: CNNVD-201908-545 // 
            
            
            
            NVD: CVE-2019-1944

CREDITS
Francesco Giordano of Hacktive Security for reporting these vulnerabilities.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201908-545

SOURCES
db:VULHUBid:VHN-151886
db:VULMONid:CVE-2019-1944
db:JVNDBid:JVNDB-2019-007652
db:CNNVDid:CNNVD-201908-545
db:NVDid:CVE-2019-1944

LAST UPDATE DATE
2024-08-14T14:04:18.760000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-151886date:2020-10-16T00:00:00
db:VULMONid:CVE-2019-1944date:2020-10-16T00:00:00
db:JVNDBid:JVNDB-2019-007652date:2019-08-16T00:00:00
db:CNNVDid:CNNVD-201908-545date:2019-08-21T00:00:00
db:NVDid:CVE-2019-1944date:2020-10-16T14:37:55.213

SOURCES RELEASE DATE
db:VULHUBid:VHN-151886date:2019-08-07T00:00:00
db:VULMONid:CVE-2019-1944date:2019-08-07T00:00:00
db:JVNDBid:JVNDB-2019-007652date:2019-08-16T00:00:00
db:CNNVDid:CNNVD-201908-545date:2019-08-07T00:00:00
db:NVDid:CVE-2019-1944date:2019-08-07T22:15:15.900