Vulnerabilities / Threats

2/7/2018
02:18 PM
50%
50%

Cisco Issues New Patch for Critical ASA Vulnerability

Cisco engineers discover that the flaw in Adaptive Security Appliance devices is worse than they initially understood.

One week after network administrators had begun deploying patches for a critical (CVSS 10.0) vulnerability in Cisco Adaptive Security Appliance (ASA) devices, Cisco released a second advisory, stating that the patch would not fix the whole problem.

Cisco released an updated patch Monday, and although there are no reports of active exploits, they urge customers to deploy the fix right away.

The vulnerability, CVE-2018-0101, is a remote code execution flaw in the ASA software XML parser that requires no authentication to exploit. It was originally fixed Jan. 29. The updated patch was necessary, because after further investigation, Cisco engineers discovered that the vuln affected more features and had more attack vectors than they initially believed.

"In addition," Cisco principal engineer Omar Santos wrote in the Cisco Product Security Incident Response Team blog, "it was also found that the original list of fixed releases published in the security advisory were later found to be vulnerable to additional denial of service conditions."  

For more information, see here

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
2018 on Track to Be One of the Worst Ever for Data Breaches
Jai Vijayan, Freelance writer,  11/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1643
PUBLISHED: 2018-11-15
The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure...
CVE-2018-0693
PUBLISHED: 2018-11-15
Directory traversal vulnerability in FileZen V3.0.0 to V4.2.1 allows remote attackers to upload an arbtrary file in the specific directory in FileZen via unspecified vectors.
CVE-2018-0694
PUBLISHED: 2018-11-15
FileZen V3.0.0 to V4.2.1 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
CVE-2018-0695
PUBLISHED: 2018-11-15
Cross-site scripting vulnerability in User-friendly SVN (USVN) Version 1.0.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-0697
PUBLISHED: 2018-11-15
Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.