CVE-2019-1873 — Uncontrolled Resource Consumption in Cisco Adaptive Security Appliance Software

CWE-400 — Uncontrolled Resource ConsumptionCWE-20 — Improper Input Validation4 documents4 sources
Severity
8.6HIGHNVD
EPSS
0.5%
top 32.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Cisco Adaptive Security Appliance SoftwareCisco ASA 5506-x FirmwareCisco ASA 5506h-x Firmware+3 more
Timeline
PublishedJul 10
Latest updateMay 24

Description

A vulnerability in the cryptographic driver for Cisco Adaptive Security Appliance Software (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reboot unexpectedly. The vulnerability is due to incomplete input validation of a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) ingress packet header. An attacker could exploit this vulnerability by sending a crafted TLS/SSL packet to an interface on the targeted device. A…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 3.9 | Impact: 4.0

Affected Packages6 packages

▶CVEListV5cisco/cisco_adaptive_security_appliance_softwareunspecified — 9.4.4.36+5
▶NVDcisco/asa_5506-x_firmware9.6\(4.16\), 9.8\(3.8\)+1
▶NVDcisco/asa_5508-x_firmware9.6\(4.16\), 9.8\(3.8\)+1
▶NVDcisco/asa_5516-x_firmware9.6\(4.16\), 9.8\(3.8\)+1
▶NVDcisco/asa_5506h-x_firmware9.6\(4.16\), 9.8\(3.8\)+1

🔴Vulnerability Details

2
GHSA
GHSA-q443-v72w-7x2v: A vulnerability in the cryptographic driver for Cisco Adaptive Security Appliance Software (ASA) and Firepower Threat Defense (FTD) Software could all↗2022-05-24
▶
CVEList
Cisco ASA and FTD Software Cryptographic TLS and SSL Driver Denial of Service Vulnerability↗2019-07-10
▶

📋Vendor Advisories

1
Cisco
Cisco ASA and FTD Software Cryptographic TLS and SSL Driver Denial of Service Vulnerability↗2019-07-10
▶
CVE-2019-1873 — Uncontrolled Resource Consumption | cvebase