ID
VAR-202107-0426
CVE
CVE-2021-1585
TITLE
Pillow Buffer error vulnerability
Trust: 0.6
DESCRIPTION
A vulnerability in the Cisco Adaptive Security Device Manager (ASDM) Launcher could allow an unauthenticated, remote attacker to execute arbitrary code on a user's operating system. This vulnerability is due to a lack of proper signature verification for specific code exchanged between the ASDM and the Launcher. An attacker could exploit this vulnerability by leveraging a man-in-the-middle position on the network to intercept the traffic between the Launcher and the ASDM and then inject arbitrary code. A successful exploit could allow the attacker to execute arbitrary code on the user's operating system with the level of privileges assigned to the ASDM Launcher. A successful exploit may require the attacker to perform a social engineering attack to persuade the user to initiate communication from the Launcher to the ASDM. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Cisco Adaptive Security Device Manager is a security device manager of Cisco (Cisco)
Trust: 1.62
AFFECTED PRODUCTS
| vendor: | cisco | model: | adaptive security device manager | scope: | lt | version: | 7.18.1.152 | Trust: 1.0 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-94 | Trust: 1.1 |
THREAT TYPE
remote
Trust: 0.6
TYPE
other
Trust: 0.6
PATCH
| title: | Cisco Adaptive Security Device Manager Fixes for code injection vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=156161 | Trust: 0.6 |
| title: | Cisco: Cisco Adaptive Security Device Manager Remote Code Execution Vulnerability | url: | https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-asdm-rce-gqjShXW | Trust: 0.1 |
| title: | staystaystay | url: | https://github.com/jbaines-r7/staystaystay | Trust: 0.1 |
| title: | The Way | url: | https://github.com/jbaines-r7/theway | Trust: 0.1 |
| title: | Cisco ASA Research | url: | https://github.com/jbaines-r7/cisco_asa_research | Trust: 0.1 |
| title: | sec-tools | url: | https://github.com/matengfei000/sec-tools | Trust: 0.1 |
| title: | sec-tools | url: | https://github.com/anquanscan/sec-tools | Trust: 0.1 |
| title: | PoC in GitHub | url: | https://github.com/soosmile/POC | Trust: 0.1 |
| title: | PoC in GitHub | url: | https://github.com/manas3c/CVE-POC | Trust: 0.1 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-1585 | Trust: 1.8 |
| db: | CS-HELP | id: | SB2021041363 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202104-975 | Trust: 0.6 |
| db: | AUSCERT | id: | ESB-2021.2325.2 | Trust: 0.6 |
| db: | CS-HELP | id: | SB2021070815 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202107-312 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-374639 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2021-1585 | Trust: 0.1 |
REFERENCES
| url: | https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-asdm-rce-gqjshxw | Trust: 2.5 |
| url: | https://github.com/jbaines-r7/staystaystay | Trust: 1.9 |
| url: | https://www.rapid7.com/blog/post/2022/08/11/rapid7-discovered-vulnerabilities-in-cisco-asa-asdm-and-firepower-services-software/ | Trust: 1.8 |
| url: | https://www.cybersecurity-help.cz/vdb/sb2021041363 | Trust: 0.6 |
| url: | https://www.cybersecurity-help.cz/vdb/sb2021070815 | Trust: 0.6 |
| url: | https://www.auscert.org.au/bulletins/esb-2021.2325.2 | Trust: 0.6 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-1585 | Trust: 0.6 |
| url: | https://cwe.mitre.org/data/definitions/94.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | VULHUB | id: | VHN-374639 |
| db: | VULMON | id: | CVE-2021-1585 |
| db: | CNNVD | id: | CNNVD-202104-975 |
| db: | CNNVD | id: | CNNVD-202107-312 |
| db: | NVD | id: | CVE-2021-1585 |
LAST UPDATE DATE
2024-08-14T12:09:21.163000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-374639 | date: | 2022-08-19T00:00:00 |
| db: | VULMON | id: | CVE-2021-1585 | date: | 2023-12-15T00:00:00 |
| db: | CNNVD | id: | CNNVD-202104-975 | date: | 2021-04-14T00:00:00 |
| db: | CNNVD | id: | CNNVD-202107-312 | date: | 2022-08-17T00:00:00 |
| db: | NVD | id: | CVE-2021-1585 | date: | 2023-12-15T17:14:06.997 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-374639 | date: | 2021-07-08T00:00:00 |
| db: | VULMON | id: | CVE-2021-1585 | date: | 2021-07-08T00:00:00 |
| db: | CNNVD | id: | CNNVD-202104-975 | date: | 2021-04-13T00:00:00 |
| db: | CNNVD | id: | CNNVD-202107-312 | date: | 2021-07-07T00:00:00 |
| db: | NVD | id: | CVE-2021-1585 | date: | 2021-07-08T19:15:09.207 |