FYI...
- https://tools.cisco....cationListing.x
Cisco ASA Software Identity Firewall Feature Buffer Overflow Vuln
- https://tools.cisco....161019-asa-idfw
19 Oct 2016 v1.1 Critical - "Summary: A vulnerability in the Identity Firewall feature of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected code area. An attacker could exploit this vulnerability by sending a crafted NetBIOS packet in response to a NetBIOS probe sent by the ASA software. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or cause a reload of the affected system.
Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed and transparent firewall mode and in single or multiple context mode. This vulnerability can be triggered by IPv4 traffic.
Cisco has released software updates that address this vulnerability. There is a workaround that addresses this vulnerability...
Vulnerable Products: This vulnerability affects Cisco ASA Software configured with the Identity Firewall feature and with NetBIOS probing enabled. To verify whether NetBIOS probing is enabled, use the show running-config user-identity | include logout-probe command and verify that the command returns output..."
- http://www.securityt....com/id/1037059
CVE Reference: CVE-2016-6432
Oct 19 2016
Fix Available: Yes Vendor Confirmed: Yes ...
The following models are affected:
ASA 5500 Series Adaptive Security Appliances
ASA 5500-X Series Next-Generation Firewalls
Catalyst 6500 Series/7600 Series ASA Services Module
ASA 1000V Cloud Firewall
Adaptive Security Virtual Appliance (ASAv)
ASA for Firepower 9300 Series
ASA for Firepower 4100 Series
ISA 3000 Industrial Security Appliance
The vendor has assigned bug ID CSCvb19843 to this vulnerability...
Impact: A remote user can execute arbitrary code on the target system.
Solution: The vendor has issued a fix...
___
Cisco ASA Software Local Certificate Authority DoS Vuln
- https://tools.cisco....20161019-asa-ca
19 Oct 2016 v1.1 High - "Summary: A vulnerability in the local Certificate Authority (CA) feature of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper handling of crafted packets during the enrollment operation. An attacker could exploit this vulnerability by sending a crafted enrollment request to the affected system. An exploit could allow the attacker to cause the reload of the affected system.
Note: Only HTTPS packets directed to the Cisco ASA interface, where the local CA is allowing user enrollment, can be used to trigger this vulnerability. This vulnerability affects systems configured in routed firewall mode and in single or multiple context mode.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability...
Vulnerable Cisco ASA Software running on the following products may be affected by this vulnerability:
Cisco ASA 5500 Series Adaptive Security Appliances
Cisco ASA 5500-X Series Next-Generation Firewalls
Cisco Adaptive Security Virtual Appliance (ASAv)
Cisco ASA for Firepower 9300 Series
Cisco ASA for Firepower 4100 Series
Cisco ISA 3000 Industrial Security Appliance
Refer to the "Fixed Software" section of this security advisory for more information about the affected releases...
Vulnerable Products: Cisco ASA Software is affected by this vulnerability if the local CA feature is configured. To verify whether the local CA is configured, use the show crypto ca server command and verify that the output shows the local CA state enabled...
- http://www.securityt....com/id/1037060
CVE Reference: CVE-2016-6431
Oct 19 2016
Impact: Denial of service via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 8.0, 8.1, 8.2, 8.3, 8.4, 8.6, 9.0, 9.1, 9.2, 9.3, 9.4, 9.5, 9.6 ...
The vendor has assigned bug ID CSCuz47295 to this vulnerability.
Impact: A remote user can cause the target system to reload.
Solution: The vendor has issued a fix (9.0(4.42), 9.1(7.7), 9.2(4.13), 9.3(3.11), 9.4(3.6), 9.5(3), 9.6(1.5))...
___
Cisco Firepower Detection Engine HTTP DoS Vuln
- https://tools.cisco....0161019-fpsnort
19 Oct 2016 v1.0 High - "Summary: A vulnerability in the detection engine reassembly of HTTP packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the Snort process unexpectedly restarting. The vulnerability is due to improper handling of an HTTP packet stream. An attacker could exploit this vulnerability by sending a crafted HTTP packet stream to the detection engine on the targeted device. An exploit could allow the attacker to cause a DoS condition if the Snort process restarts and traffic inspection is bypassed or traffic is dropped. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability...
Vulnerable Products: The following Cisco products are affected when they are running software versions 5.4.1.5, 6.0, or 6.0.0.1
Adaptive Security Appliance (ASA) 5500-X Series with FirePOWER Services
Advanced Malware Protection (AMP) for Networks, 7000 Series Appliances
Advanced Malware Protection (AMP) for Networks, 8000 Series Appliances
Firepower 4100 Series Security Appliances
FirePOWER 7000 Series Appliances
FirePOWER 8000 Series Appliances
Firepower 9300 Series Security Appliances
FirePOWER Threat Defense for Integrated Services Routers (ISRs)
Sourcefire 3D System Appliances
Virtual Next-Generation Intrusion Prevention System (NGIPSv) for VMware
This vulnerability also affects the open source Snort project. For more information, see the Snort website:
- https://www.snort.org/
Details: This vulnerability can result in the Snort process restarting. While the Snort process is restarting, Snort detection could be bypassed or all network traffic inspection could fail. The behavior is platform and configuration dependent.
FirePOWER Platforms:
Passive and bypass interfaces will bypass Snort inspection and pass the traffic.
Routed, switched, and non-bypass interfaces will drop the traffic.
FirePOWER Threat Defense (FTD) will drop the traffic.
Adaptive Security Appliance (ASA) 5500-X Series with FirePOWER Services
If the ASA release supports the command-line interface (CLI) command sfr fail-open and it is configured, traffic will bypass Snort and not be dropped.
Workarounds: There are no workarounds that address this vulnerability...
- http://www.securityt....com/id/1037061
CVE Reference: CVE-2016-6439
Oct 19 2016
Impact: Denial of service via network, Host/resource access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): 5500-X Series with FirePOWER Services; 5.4.1.5, 6.0, 6.0.0.1 ...
The vendor has assigned bug ID CSCux61630 to this vulnerability.
Impact: A remote user can cause the target Snort service to restart, bypassing Snort detection while the service restarts.
Solution: The vendor has issued a fix...
___
Cisco Meeting Server Cross-Site Request Forgery Vuln
- https://tools.cisco....sa-20161019-cms
19 Oct 2016 v1.0 - "Summary: A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a Web Bridge user. The vulnerability is due to insufficient CSRF protections. An attacker could exploit this vulnerability by convincing the user of the affected system to follow a malicious link or visit an attacker-controlled website. A successful exploit could allow an attacker to submit arbitrary requests to the affected device via the Web Bridge with the privileges of the user. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available...
Vulnerable Products: Cisco Meeting Server is vulnerable...
Fixed Software: Cisco Meeting Server version 2.0.4 software is available for download at Cisco's Software Download Center:
- https://software.cis...mdfid=286309710
Acano Meeting Server version 1.9.5 software is available for download on Acano's website:
- https://www.acano.co...port/downloads/
Cisco provides information about fixed software in Cisco bugs, which are accessible through the Cisco Bug Search Tool: https://bst.cloudapp....com/bugsearch/
CVE-2016-6444
Cisco Bug IDs: CSCvb03308
___
Cisco Meeting Server Information Disclosure Vuln
- https://tools.cisco....a-20161019-cms1
19 Oct 2016 v1.0 - "Summary: A vulnerability in Web Bridge for Cisco Meeting Server could allow an unauthenticated, remote attacker to retrieve memory from a connected server. The vulnerability is due to missing bounds checks in the Web Bridge functionality. An attacker could exploit this vulnerability by sending a crafted packet to the affected server. An exploit could allow the attacker to disclose a portion of memory from the server for every packet. The disclosed portions of memory could contain sensitive information such as private keys or passwords. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available...
Vulnerable Products: Cisco Meeting Server is affected...
Fixed Software: Cisco Meeting Server version 2.0.4 software is available for download at Cisco's Software Download Center:
- https://software.cis...mdfid=286309710
Acano Meeting Server version 1.9.5 software is available for download on Acano's website:
- https://www.acano.co...port/downloads/
Cisco provides information about fixed software in Cisco bugs, which are accessible through the Cisco Bug Search Tool: https://bst.cloudapp....com/bugsearch/
CVE-2016-6446
Cisco Bug IDs: CSCvb03308
___
- https://www.us-cert....ecurity-Updates
Oct 19, 2016
Edited by AplusWebMaster, 20 October 2016 - 06:04 AM.
Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
