Cisco Adaptive Security Appliance Firepower Threat Defense目录遍历漏洞

详细信息

漏洞类型

输入验证错误

漏洞描述

Cisco 3000 Series Industrial Security Appliance（ISA）等都是美国思科（Cisco）公司的安全设备。ASA Software和Firepower Threat Defense (FTD)Software都是分别运行在不同设备中的操作系统。Cisco Adaptive Security Appliance（ASA）的web界面中存在漏洞，未经验证的远程攻击者可能会导致受影响的设备意外重新加载，从而导致拒绝服务（DoS）情况。在某些软件版本上，ASA也可能不会重新加载，但攻击者可以使用目录遍历技术查看敏感系统信息，而无需验证。该漏洞是由于缺少HTTP URL的正确输入验证造成的。攻击者可以通过向受影响的设备发送精心编制的HTTP请求来攻击此漏洞。攻击者利用此漏洞可造成DoS情况或未经验证的信息泄露。

修复建议

请参阅Cisco-sa-20180606-asaftd，了解补丁、升级或建议的解决方法信息： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd

参考链接

• https://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html

  CVE · x_refsource_MISC

• https://ics-cert.us-cert.gov/advisories/ICSA-18-184-01

  CVE · x_refsource_MISC

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd

  CVE · x_refsource_CONFIRM

• https://www.exploit-db.com/exploits/44956/

  CVE · exploit · x_refsource_EXPLOIT-DB

• https://www.exploit-db.com/exploits/47220
• https://vigilance.fr/vulnerability/Cisco-ASA-denial-of-service-via-HTTP-URL-28680
• http://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html

  CVE · x_refsource_MISC

• https://www.cisa.gov/news-events/ics-advisories/icsa-18-184-01
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0296

  NVD · US Government Resource