Veille CVE
CVE-2016-6366
8.8 Élevée Exploitée activementCatalogue CISA KEV — Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability
Ajoutée le 24/05/2022 · Échéance de correction (agences US) : 14/06/2022
Action requise : Apply updates per vendor instructions.
Description
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 8.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 8.5 Élevée | nvd@nist.gov (NVD) | AV:N/AC:M/Au:S/C:C/I:C/A:C |
Faiblesses (CWE)
Références
- http://blogs.cisco.com/security/shadow-brokers ExploitPress/Media CoverageVendor Advisory
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp Vendor Advisory
- http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516 Vendor Advisory
- http://www.securityfocus.com/bid/92521 Broken LinkNot ApplicableThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1036637 Broken LinkThird Party AdvisoryVDB Entry
- https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip Broken LinkExploit
- https://www.exploit-db.com/exploits/40258/ Third Party AdvisoryVDB Entry
- https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html ExploitTechnical Description
- http://blogs.cisco.com/security/shadow-brokers ExploitPress/Media CoverageVendor Advisory
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp Vendor Advisory
- http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516 Vendor Advisory
- http://www.securityfocus.com/bid/92521 Broken LinkNot ApplicableThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1036637 Broken LinkThird Party AdvisoryVDB Entry
- https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip Broken LinkExploit
- https://www.exploit-db.com/exploits/40258/ Third Party AdvisoryVDB Entry
- https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html ExploitTechnical Description
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6366 US Government Resource