CVE-2019-12673
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD
Description
A vulnerability in the FTP inspection engine of Cisco Adaptive Security (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient validation of FTP data. An attacker could exploit this vulnerability by sending malicious FTP traffic through an affected device. A successful exploit could allow the attacker to cause a DoS condition on the affected device.
Affected (7)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 9.6.4.34 | |
| From 9.10 to 9.10.1.30 |
| Running on/with | Platform Versions |
|---|---|
Cisco Asa 5505 | All versions |
Cisco Asa 5510 | All versions |
Cisco Asa 5512 X | All versions |
Cisco Asa 5515 X | All versions |
Cisco Asa 5520 | All versions |
Cisco Asa 5525 X | All versions |
Cisco Asa 5550 | All versions |
Cisco Asa 5555 X | All versions |
Cisco Asa 5580 | All versions |
Cisco Asa 5585 X | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Before 6.3.0.5 |
Related CWEs
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-20
Improper Input Validation
The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
References (2)
Source: psirt@cisco.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.