CVE-2021-1493
published 2021-04-29CVE-2021-1493: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow…
PriorityP338high7.1CVSS 3.1
AVNACLPRLUINSUCLINAH
EPSS
1.20%
64.7th percentile
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to insufficient boundary checks for specific data that is provided to the web services interface of an affected system. An attacker could exploit this vulnerability by sending a malicious HTTP request. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system, which could disclose data fragments or cause the device to reload, resulting in a denial of service (DoS) condition.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | adaptive_security_appliance | — | — |
| cisco | adaptive_security_appliance_software | >= 9.10 < 9.12.4.13 | 9.12.4.13 |
| cisco | adaptive_security_appliance_software | >= 9.13 < 9.13.1.21 | 9.13.1.21 |
| cisco | adaptive_security_appliance_software | >= 9.14 < 9.14.2.8 | 9.14.2.8 |
| cisco | adaptive_security_appliance_software | >= 9.15 < 9.15.1.7 | 9.15.1.7 |
| cisco | adaptive_security_appliance_software | >= 9.8 < 9.8.4.34 | 9.8.4.34 |
| cisco | adaptive_security_appliance_software | >= 9.9 < 9.9.2.85 | 9.9.2.85 |
| cisco | cisco_adaptive_security_appliance_software | — | — |
| cisco | firepower_threat_defense | < 6.4.0.12 | 6.4.0.12 |
| cisco | firepower_threat_defense | >= 6.5.0 < 6.6.3 | 6.6.3 |
| cisco | firepower_threat_defense | >= 6.7.0 < 6.7.0.1 | 6.7.0.1 |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:S/C:P/I:N/A:C
vendor_cisco8.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for Desktop: CVE-2022-1492
vendor_chrome·2022-04-26·CVSS 6.1
CVE-2022-1492 [MEDIUM] Stable Channel Update for Desktop: CVE-2022-1492
Stable Channel Update for Desktop
CVE-2022-1492: Insufficient data validation in Blink Editing. Reported by Michał Bentkowski of Securitum on 2022-04-11 [$1000][ 1275414 ] Medium CVE-2022-1493: Use after free in Dev Tools
Reported by Zhihua Yao of KunLun Lab on 2021-12-01 [$1000][ 1298122 ] Medium CVE-2022-1494: Insufficient data validation in Trusted Types
Severity: medium
Cisco
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Buffer Overflow Denial of Service Vulnerability
vendor_cisco·2021-04-28·CVSS 8.5
CVE-2021-1493 [HIGH] CWE-120 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Buffer Overflow Denial of Service Vulnerability
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Buffer Overflow Denial of Service Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system.
The vulnerability is due to insufficient boundary checks for specific data that is provided to the web services interface of an affected system. An attacker could exploit this vulnerability by sending a malicious HTTP request. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system, which could disclose data fragments or cause the device to reload, resulting i
Cisco
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Buffer Overflow Denial of Service Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1493 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Buffer Overflow Denial of Service Vulnerability
CVE-2021-1493: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Buffer Overflow Denial of Service Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to insufficient boundary checks for specific data that is provided to the web services interface of an affected system. An attacker could exploit this vulnerability by sending a malicious HTTP request. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system, which could disclose data fragments or cause the device to reload
GHSA
GHSA-4f73-r2j2-j4h5: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software co
ghsa_unreviewed·2022-05-24
CVE-2021-1493 [HIGH] CWE-120 GHSA-4f73-r2j2-j4h5: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software co
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to insufficient boundary checks for specific data that is provided to the web services interface of an affected system. An attacker could exploit this vulnerability by sending a malicious HTTP request. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system, which could disclose data fragments or cause the device to reload, resulting in a denial of service (DoS) condition.
No detection rules found.
No public exploits indexed.
Talos
Threat Source Newsletter (May 6, 2021)
blogs_talos·2021-05-06
Threat Source Newsletter (May 6, 2021)
## Threat Source Newsletter (May 6, 2021)
Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
COVID-19 has changed everything about our lives — no surprise there. So it also shouldn't be shocking that it's changing the way Americans view Tax Day this year.
The deadline to file taxes is about a month later than usual and is now only 11 days away. Attackers have jumped on this opportunity to create new malware campaigns centered around taxes and COVID-19. You don't want to miss the latest Talos Takes episode where we talk about scams around supposed rewards for receiving your COVID vaccine, promises of better tax returns, and everything else you could think of with "taxes" in the subject line of a spam email.
## Upcoming public engagements with Talos
Title: Cisco Secure
Talos
Threat Source Newsletter (May 6, 2021)
blogs_talos·2021-05-06
Threat Source Newsletter (May 6, 2021)
Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
COVID-19 has changed everything about our lives — no surprise there. So it also shouldn't be shocking that it's changing the way Americans view Tax Day this year.
The deadline to file taxes is about a month later than usual and is now only 11 days away. Attackers have jumped on this opportunity to create new malware campaigns centered around taxes and COVID-19. You don't want to miss the latest Talos Takes episode where we talk about scams around supposed rewards for receiving your COVID vaccine, promises of better tax returns, and everything else you could think of with "taxes" in the subject line of a spam email.
## Upcoming public engagements with Talos
Title:Cisco Secure at RSA 2021
Date: May 17 - 20
Overview: Co
2021-04-29
Published