CVE-2013-5510: Medium severity cisco adaptive security appliance vulnerability

Published Oct 13, 2013

Updated

The remote-access VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 7.x before 7.2(5.12), 8.x before 8.2(5.46), 8.3.x before 8.3(2.39), 8.4.x before 8.4(6), 8.6.x before 8.6(1.12), 9.0.x before 9.0(3.1), and 9.1.x before 9.1(2.5), when an override-account-disable option is enabled, does not properly parse AAA LDAP responses, which allows remote attackers to bypass authentication via a VPN connection attempt, aka Bug ID CSCug83401.

Affected Software

85 affected components

Cisco Adaptive Security Appliance Software=7.0

Cisco Adaptive Security Appliance Software=7.0\(0\)

Cisco Adaptive Security Appliance Software=7.0\(1\)

Cisco Adaptive Security Appliance Software=7.0\(2\)

Cisco Adaptive Security Appliance Software=7.0\(4\)

Cisco Adaptive Security Appliance Software=7.0\(5\)

Cisco Adaptive Security Appliance Software=7.0\(5.2\)

Cisco Adaptive Security Appliance Software=7.0\(6\)

Cisco Adaptive Security Appliance Software=7.0\(6.7\)

Cisco Adaptive Security Appliance Software=7.0\(7\)

Cisco Adaptive Security Appliance Software=7.0\(8\)

Cisco Adaptive Security Appliance Software=7.0.1

Cisco Adaptive Security Appliance Software=7.0.1.4

Cisco Adaptive Security Appliance Software=7.0.2

Cisco Adaptive Security Appliance Software=7.0.4

Cisco Adaptive Security Appliance Software=7.0.4.3

Cisco Adaptive Security Appliance Software=7.0.5

Cisco Adaptive Security Appliance Software=7.0.6

Cisco Adaptive Security Appliance Software=7.0.7

Cisco Adaptive Security Appliance Software=7.0.8

Cisco Adaptive Security Appliance Software=7.0.8-interim

Cisco Adaptive Security Appliance Software=7.1

Cisco Adaptive Security Appliance Software=7.1\(2\)

Cisco Adaptive Security Appliance Software=7.1\(2.5\)

Cisco Adaptive Security Appliance Software=7.1\(2.27\)

Cisco Adaptive Security Appliance Software=7.1\(2.48\)

Cisco Adaptive Security Appliance Software=7.1\(2.49\)

Cisco Adaptive Security Appliance Software=7.1\(5\)

Cisco Adaptive Security Appliance Software=7.1.1

Cisco Adaptive Security Appliance Software=7.1.2

Cisco Adaptive Security Appliance Software=7.2

Cisco Adaptive Security Appliance Software=7.2\(1\)

Cisco Adaptive Security Appliance Software=7.2\(1.22\)

Cisco Adaptive Security Appliance Software=7.2\(2\)

Cisco Adaptive Security Appliance Software=7.2\(2.5\)

Cisco Adaptive Security Appliance Software=7.2\(2.7\)

Cisco Adaptive Security Appliance Software=7.2\(2.8\)

Cisco Adaptive Security Appliance Software=7.2\(2.10\)

Cisco Adaptive Security Appliance Software=7.2\(2.14\)

Cisco Adaptive Security Appliance Software=7.2\(2.15\)

Cisco Adaptive Security Appliance Software=7.2\(2.16\)

Cisco Adaptive Security Appliance Software=7.2\(2.17\)

Cisco Adaptive Security Appliance Software=7.2\(2.18\)

Cisco Adaptive Security Appliance Software=7.2\(2.19\)

Cisco Adaptive Security Appliance Software=7.2\(2.48\)

Cisco Adaptive Security Appliance Software=7.2\(3\)

Cisco Adaptive Security Appliance Software=7.2\(4\)

Cisco Adaptive Security Appliance Software=7.2\(5\)

Cisco Adaptive Security Appliance Software=8.0

Cisco Adaptive Security Appliance Software=8.0\(2\)

Cisco Adaptive Security Appliance Software=8.0\(3\)

Cisco Adaptive Security Appliance Software=8.0\(4\)

Cisco Adaptive Security Appliance Software=8.0\(5\)

Cisco Adaptive Security Appliance Software=8.0\(5.28\)

Cisco Adaptive Security Appliance Software=8.0\(5.31\)

Cisco Adaptive Security Appliance Software=8.0.2

Cisco Adaptive Security Appliance Software=8.0.3

Cisco Adaptive Security Appliance Software=8.0.4

Cisco Adaptive Security Appliance Software=8.0.5

Cisco Adaptive Security Appliance Software=8.1

Cisco Adaptive Security Appliance Software=8.2

Cisco Adaptive Security Appliance Software=8.2\(1\)

Cisco Adaptive Security Appliance Software=8.2\(2\)

Cisco Adaptive Security Appliance Software=8.2\(3\)

Cisco Adaptive Security Appliance Software=8.2\(3.9\)

Cisco Adaptive Security Appliance Software=8.2\(4\)

Cisco Adaptive Security Appliance Software=8.2\(4.1\)

Cisco Adaptive Security Appliance Software=8.2\(4.4\)

Cisco Adaptive Security Appliance Software=8.2\(5\)

Cisco Adaptive Security Appliance Software=8.2\(5.35\)

Cisco Adaptive Security Appliance Software=8.2\(5.38\)

Cisco Adaptive Security Appliance Software=8.4

Cisco Adaptive Security Appliance Software=8.4\(1\)

Cisco Adaptive Security Appliance Software=8.4\(1.11\)

Cisco Adaptive Security Appliance Software=8.4\(2\)

Cisco Adaptive Security Appliance Software=8.4\(2.11\)

Cisco Adaptive Security Appliance Software=8.4\(3\)

Cisco Adaptive Security Appliance Software=8.4\(4.11\)

Cisco Adaptive Security Appliance Software=8.4\(5\)

Cisco Adaptive Security Appliance Software=8.6

Cisco Adaptive Security Appliance Software=8.6\(1\)

Cisco Adaptive Security Appliance Software=8.6\(1.10\)

Cisco Adaptive Security Appliance Software=9.0

Cisco Adaptive Security Appliance Software=9.1

Cisco Adaptive Security Appliance Software=9.1\(1.7\)

Event History

Oct 13, 2013

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-5510?

The severity of CVE-2013-5510 is rated as high, due to the potential for unauthorized access to the remote access VPN functionality.

How do I fix CVE-2013-5510?

To fix CVE-2013-5510, update your Cisco Adaptive Security Appliance Software to a version equal to or greater than 7.2(5.12), 8.2(5.46), or the other specified versions listed in the advisory.

Which products are affected by CVE-2013-5510?

CVE-2013-5510 affects various versions of the Cisco Adaptive Security Appliance Software, including versions 7.x, 8.x, and 9.x.

Can CVE-2013-5510 allow attackers remote access?

Yes, CVE-2013-5510 can allow attackers to gain unauthorized remote access to a vulnerable Cisco Adaptive Security Appliance.

Is CVE-2013-5510 easy to exploit?

Exploitation of CVE-2013-5510 can be achieved by attackers with access to the network, typically making it easier to exploit in environments where the firewall is misconfigured.