首页 -> 安全研究

安全研究

安全漏洞
Cisco多个产品拒绝服务漏洞(CVE-2019-1697)

发布日期:2019-06-06
更新日期:2019-06-06

受影响系统:
Cisco Firepower Threat Defense Software
Cisco Cisco Firepower Threat Defense Virtual (FTDv)
Cisco Cisco Firepower Threat Defense Software 6.3
Cisco Cisco Firepower Threat Defense Software 6.2.3
Cisco Cisco Firepower Threat Defense Software 6.2.2
Cisco Cisco Firepower Threat Defense Software 6.2.1
Cisco Cisco Firepower 9300 Security Appliance
Cisco Cisco Firepower 4100 Series
Cisco Cisco Firepower 2100 Series
Cisco Cisco ASA Services Module for Cisco Catalyst 6500
Cisco Cisco ASA Services Module for Cisco 7600 Series Ro
Cisco Cisco ASA 5500-X Series Firewalls
Cisco Cisco Adaptive Security Virtual Appliance (ASAv)
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.9
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.9
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.8
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.8
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.7
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.7
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.6
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.6
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.10
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.10
Cisco Cisco 3000 Series Industrial Security Appliance (I
不受影响系统:
Cisco Firepower Threat Defense Software 6.3.0.3
Cisco Firepower Threat Defense Software 6.2.3.12
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.9.2.50
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.8.4
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.6.4.25
Cisco Cisco Adaptive Security Appliance (ASA) Software 9.10.1.17
描述:
BUGTRAQ  ID: 108182
CVE(CAN) ID: CVE-2019-1697

思科自适应安全设备 (ASA) 软件是为 Cisco ASA 系列提供强大功能的核心操作系统。它拥有多种外观,为 ASA 设备提供企业级防火墙功能 - 独立式设备(US)、刀片(US)和虚拟。ASA 软件还与其他关键安全技术集成,以提供功能全面的解决方案,满足不断发展的安全需要。
思科的FirePower Threat Defense(FTD)软件整合了ASA特性以及FirePower特性的软性。
思科自适应安全设备(ASA)软件和Firepower威胁防御(FTD)软件中轻量级目录访问协议(LDAP)功能实施中的漏洞可能允许未经身份验证的远程攻击者导致受影响的设备重新加载,从而导致拒绝服务(DoS)条件。这些漏洞是由于对发送到受影响设备的LDAP数据包的解析不当造成的。攻击者可以通过使用基本编码规则(BER)发送精心设计的LDAP数据包来利用这些漏洞,以便受影响的设备进行处理。成功利用可能允许攻击者重新加载受影响的设备,从而导致DoS状况。

<*来源:Marcelo Coelho
  
  链接:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftds-lda
*>

建议:
厂商补?。?br />
Cisco
-----
Cisco已经为此发布了一个安全公告(cisco-sa-20190501-asa-ftds-ldapdos)以及相应补丁:
cisco-sa-20190501-asa-ftds-ldapdos:Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Lightweight Directory Access Protocol Denial of Service Vulnerability
链接:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftds-lda

补丁下载:

浏览次数:2212
严重程度:0(网友投票)
本安全漏洞由绿盟科技翻译整理,版权所有,未经许可,不得转载
绿盟科技给您安全的保障
大话西游试玩 蒸气炸弹电子游艺 金字塔的财富免费试玩 北极特务APP下载 百搭小丑扑克登陆 阿兹特克宝藏援彩金 银弹怎么玩 幸运农场历史开奖 新快3计划 湖北十一选五走势图一定牛