Vulnerabilities / Threats

2/7/2018
02:18 PM
50%
50%

Cisco Issues New Patch for Critical ASA Vulnerability

Cisco engineers discover that the flaw in Adaptive Security Appliance devices is worse than they initially understood.

One week after network administrators had begun deploying patches for a critical (CVSS 10.0) vulnerability in Cisco Adaptive Security Appliance (ASA) devices, Cisco released a second advisory, stating that the patch would not fix the whole problem.

Cisco released an updated patch Monday, and although there are no reports of active exploits, they urge customers to deploy the fix right away.

The vulnerability, CVE-2018-0101, is a remote code execution flaw in the ASA software XML parser that requires no authentication to exploit. It was originally fixed Jan. 29. The updated patch was necessary, because after further investigation, Cisco engineers discovered that the vuln affected more features and had more attack vectors than they initially believed.

"In addition," Cisco principal engineer Omar Santos wrote in the Cisco Product Security Incident Response Team blog, "it was also found that the original list of fixed releases published in the security advisory were later found to be vulnerable to additional denial of service conditions."  

For more information, see here

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3783
PUBLISHED: 2018-08-17
A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.
CVE-2018-3784
PUBLISHED: 2018-08-17
A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization.
CVE-2018-3785
PUBLISHED: 2018-08-17
A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.
CVE-2018-10873
PUBLISHED: 2018-08-17
A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malicious client or server, after authentication, could send specially crafted messages to its peer which would result in a crash or, potentially,...
CVE-2018-5546
PUBLISHED: 2018-08-17
The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host. A malicious local unprivileged user may gain knowledge of se...