CVE-2013-3415: Buffer Overflow

Published Oct 13, 2013

Updated

Cisco Adaptive Security Appliance (ASA) Software 8.4.x before 8.4(3) and 8.6.x before 8.6(1.3) does not properly manage memory upon an AnyConnect SSL VPN client disconnection, which allows remote attackers to cause a denial of service (memory consumption, and forwarding outage or system hang) via packets to the disconnected machine's IP address, aka Bug ID CSCtt36737.

Affected Software

8 affected components

Cisco Adaptive Security Appliance Software=8.4

Cisco Adaptive Security Appliance Software=8.4\(1\)

Cisco Adaptive Security Appliance Software=8.4\(1.11\)

Cisco Adaptive Security Appliance Software=8.4\(2\)

Cisco Adaptive Security Appliance Software=8.4\(2.11\)

Cisco Adaptive Security Appliance Software=8.6

Cisco Adaptive Security Appliance Software=8.6\(1\)

Cisco Adaptive Security Appliance Software=8.6\(1.10\)

Event History

Oct 13, 2013

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3415?

CVE-2013-3415 has a critical severity level due to the potential for denial of service attacks on the affected devices.

How do I fix CVE-2013-3415?

To fix CVE-2013-3415, upgrade Cisco Adaptive Security Appliance software to version 8.4(3) or 8.6(1.3) or later.

What versions are affected by CVE-2013-3415?

CVE-2013-3415 affects Cisco Adaptive Security Appliance Software versions 8.4.x before 8.4(3) and 8.6.x before 8.6(1.3).

What type of vulnerability is CVE-2013-3415?

CVE-2013-3415 is a memory management vulnerability that can lead to denial of service conditions.

Who can exploit CVE-2013-3415?

Remote attackers can exploit CVE-2013-3415 by disconnecting an AnyConnect SSL VPN client, leading to system disruption.