cisco-sa-20191002-asa-ssl-vpn-dos: Cisco Adaptive Security Appliance Software SSL VPN Denial of Service Vulnerability
First published: Wed Oct 02 2019(Updated: )
A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition that prevents the creation of new SSL/Transport Layer Security (TLS) connections to an affected device. The vulnerability is due to incorrect handling of Base64-encoded strings. An attacker could exploit this vulnerability by opening many SSL VPN sessions to an affected device. The attacker would need to have valid user credentials on the affected device to exploit this vulnerability. A successful exploit could allow the attacker to overwrite a special system memory location, which will eventually result in memory allocation errors for new SSL/TLS sessions to the device, preventing successful establishment of these sessions. A reload of the device is required to recover from this condition. Established SSL/TLS connections to the device and SSL/TLS connections through the device are not affected. Note: Although this vulnerability is in the SSL VPN feature, successful exploitation of this vulnerability would affect all new SSL/TLS sessions to the device, including management sessions. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-asa-ssl-vpn-dos
Credit: This vulnerability was found during the resolution a Cisco TAC support case
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco ASA | >=Earlier than 9.1=9.1=9.2=9.3<=9.4<9.4.2.11 | 9.4.2.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20191002-asa-ssl-vpn-dos?
The severity of cisco-sa-20191002-asa-ssl-vpn-dos is classified as high due to its potential to cause a denial of service.
How do I fix cisco-sa-20191002-asa-ssl-vpn-dos?
To fix cisco-sa-20191002-asa-ssl-vpn-dos, upgrade your Cisco ASA Software to version 9.4.2.11 or later.
What systems are affected by cisco-sa-20191002-asa-ssl-vpn-dos?
cisco-sa-20191002-asa-ssl-vpn-dos affects Cisco Adaptive Security Appliance (ASA) Software versions earlier than 9.4.2.11.
Can cisco-sa-20191002-asa-ssl-vpn-dos be exploited remotely?
Yes, cisco-sa-20191002-asa-ssl-vpn-dos can be exploited remotely by an authenticated attacker.
What is the impact of cisco-sa-20191002-asa-ssl-vpn-dos?
The impact of cisco-sa-20191002-asa-ssl-vpn-dos is a denial of service condition, preventing new SSL/TLS connections.
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/weakness
- agent/title
- agent/author
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/cisco-advisory
- source/Cisco
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco asa
- version/cisco asa/earlier than 9.1
- version/cisco asa/9.1
- version/cisco asa/9.2
- version/cisco asa/9.3
- version/cisco asa/9.4