CVE-2010-4680: Critical severity Cisco Adaptive Security Appliance Software vulnerability

Q: What is the impact of CVE-2010-4680?

CVE-2010-4680 allows remote authenticated users to view CIFS shares even when browsing is disabled, bypassing intended access restrictions.

Q: How do I mitigate CVE-2010-4680?

To fix CVE-2010-4680, upgrade the Cisco Adaptive Security Appliance software to version 8.2(3) or later.

Q: Which devices are affected by CVE-2010-4680?

CVE-2010-4680 affects Cisco Adaptive Security Appliances 5500 series with software versions prior to 8.2(3).

Q: What versions are vulnerable to CVE-2010-4680?

Vulnerable versions for CVE-2010-4680 include Cisco Adaptive Security Appliance software versions 7.0 and up to 8.2(2).

Q: What types of attacks can exploit CVE-2010-4680?

Exploiting CVE-2010-4680 allows attackers to make unauthorized CIFS requests to access files and shares.

Published Jan 7, 2011

Updated

The WebVPN implementation on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) permits the viewing of CIFS shares even when CIFS file browsing has been disabled, which allows remote authenticated users to bypass intended access restrictions via CIFS requests, aka Bug ID CSCsz80777.

Affected Software

58 affected components

Cisco Adaptive Security Appliance Software<=8.2\(2\)

Cisco Adaptive Security Appliance Software=7.0

Cisco Adaptive Security Appliance Software=7.0\(0\)

Cisco Adaptive Security Appliance Software=7.0\(2\)

Cisco Adaptive Security Appliance Software=7.0\(4\)

Cisco Adaptive Security Appliance Software=7.0\(5\)

Cisco Adaptive Security Appliance Software=7.0\(5.2\)

Cisco Adaptive Security Appliance Software=7.0\(6.7\)

Cisco Adaptive Security Appliance Software=7.0.1

Cisco Adaptive Security Appliance Software=7.0.1.4

Cisco Adaptive Security Appliance Software=7.0.2

Cisco Adaptive Security Appliance Software=7.0.4

Cisco Adaptive Security Appliance Software=7.0.4.3

Cisco Adaptive Security Appliance Software=7.0.5

Cisco Adaptive Security Appliance Software=7.0.6

Cisco Adaptive Security Appliance Software=7.0.7

Cisco Adaptive Security Appliance Software=7.0.8

Cisco Adaptive Security Appliance Software=7.0.8-interim

Cisco Adaptive Security Appliance Software=7.1

Cisco Adaptive Security Appliance Software=7.1\(2\)

Cisco Adaptive Security Appliance Software=7.1\(2.5\)

Cisco Adaptive Security Appliance Software=7.1\(2.27\)

Cisco Adaptive Security Appliance Software=7.1\(2.48\)

Cisco Adaptive Security Appliance Software=7.1\(2.49\)

Cisco Adaptive Security Appliance Software=7.1\(5\)

Cisco Adaptive Security Appliance Software=7.1.1

Cisco Adaptive Security Appliance Software=7.1.2

Cisco Adaptive Security Appliance Software=7.2

Cisco Adaptive Security Appliance Software=7.2\(1\)

Cisco Adaptive Security Appliance Software=7.2\(1.22\)

Cisco Adaptive Security Appliance Software=7.2\(2\)

Cisco Adaptive Security Appliance Software=7.2\(2.5\)

Cisco Adaptive Security Appliance Software=7.2\(2.7\)

Cisco Adaptive Security Appliance Software=7.2\(2.8\)

Cisco Adaptive Security Appliance Software=7.2\(2.10\)

Cisco Adaptive Security Appliance Software=7.2\(2.14\)

Cisco Adaptive Security Appliance Software=7.2\(2.15\)

Cisco Adaptive Security Appliance Software=7.2\(2.16\)

Cisco Adaptive Security Appliance Software=7.2\(2.17\)

Cisco Adaptive Security Appliance Software=7.2\(2.18\)

Cisco Adaptive Security Appliance Software=7.2\(2.19\)

Cisco Adaptive Security Appliance Software=7.2\(2.48\)

Cisco Adaptive Security Appliance Software=7.2.1

Cisco Adaptive Security Appliance Software=7.2.2

Cisco Adaptive Security Appliance Software=7.2.3

Cisco Adaptive Security Appliance Software=7.2.4

Cisco Adaptive Security Appliance Software=7.2.5

Cisco Adaptive Security Appliance Software=8.0

Cisco Adaptive Security Appliance Software=8.0.2

Cisco Adaptive Security Appliance Software=8.0.3

Cisco Adaptive Security Appliance Software=8.0.4

Cisco Adaptive Security Appliance Software=8.0.5

Cisco Adaptive Security Appliance Software=8.2\(1\)

Cisco Adaptive Security Appliance Software=8.2.1

Cisco Adaptive Security Appliance Software=8.2.2

Cisco Adaptive Security Appliance Software=8.2.2-interim

cisco 5500 Series Adaptive Security Appliance

cisco ASA 5500

Event History

Jan 7, 2011

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Data Sourced

12:00 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the impact of CVE-2010-4680?

CVE-2010-4680 allows remote authenticated users to view CIFS shares even when browsing is disabled, bypassing intended access restrictions.

How do I mitigate CVE-2010-4680?

To fix CVE-2010-4680, upgrade the Cisco Adaptive Security Appliance software to version 8.2(3) or later.

Which devices are affected by CVE-2010-4680?

CVE-2010-4680 affects Cisco Adaptive Security Appliances 5500 series with software versions prior to 8.2(3).

What versions are vulnerable to CVE-2010-4680?

Vulnerable versions for CVE-2010-4680 include Cisco Adaptive Security Appliance software versions 7.0 and up to 8.2(2).

What types of attacks can exploit CVE-2010-4680?