CVE-2008-2735: Input Validation

Published Sep 4, 2008

Updated

The HTTP server in Cisco Adaptive Security Appliance (ASA) 5500 devices 8.0 before 8.0(3)15 and 8.1 before 8.1(1)5, when configured as a clientless SSL VPN endpoint, does not properly process URIs, which allows remote attackers to cause a denial of service (device reload) via a URI in a crafted SSL or HTTP packet, aka Bug ID CSCsq19369.

Affected Software

2 affected components

Cisco Adaptive Security Appliance 5500=8.1

Cisco Adaptive Security Appliance 5500=8.0

Event History

Sep 4, 2008

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-2735?

CVE-2008-2735 has been classified with a moderate severity level due to its potential to cause a denial of service on affected devices.

How do I fix CVE-2008-2735?

To fix CVE-2008-2735, you should upgrade the Cisco Adaptive Security Appliance to version 8.0(3)15, 8.1(1)5 or later.

Which devices are affected by CVE-2008-2735?

CVE-2008-2735 affects Cisco Adaptive Security Appliance 5500 devices running firmware versions prior to 8.0(3)15 and 8.1(1)5.

What type of attack does CVE-2008-2735 facilitate?

CVE-2008-2735 allows remote attackers to execute denial of service attacks which can lead to device reloads.

Is CVE-2008-2735 specific to any particular configuration?

Yes, CVE-2008-2735 specifically affects the HTTP server in Cisco ASA devices when configured as clientless SSL VPN endpoints.