CVE-2020-3191

A vulnerability in the remote access SSL VPN feature of Cisco ASA and FTD Software could allow an authenticated, remote attacker to bypass a configured multiple certificate authentication policy and connect using only a valid username and password. This is due to improper error handling during remote access VPN authentication. An attacker could send crafted requests during session establishment, bypassing the certificate policy while retaining privileges.

A vulnerability in the IKEv2 implementation of Cisco ASA and FTD Software could allow an authenticated, remote attacker to trigger a denial of service (DoS) condition. This is due to improper resource control. An attacker who can spoof a trusted IKEv2 site-to-site VPN peer and has valid credentials could send malformed, authenticated IKEv2 messages, causing a device reload.

A vulnerability in the SNMPv3 access control functionality of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to query SNMP data. This is due to ineffective access control. An attacker could send an SNMPv3 query from a host not permitted by the ACL and retrieve information if valid credentials are held.

A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco ASA and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This is due to improper handling of network requests by devices configured with object group search. An attacker could send a specially crafted request to bypass ACL rules and send traffic to unauthorized hosts.

A vulnerability in the TLS handler of Cisco ASA and FTD Software for Firepower 1000 Series firewalls could allow an unauthenticated, remote attacker to gain access to sensitive information. The issue is due to improper implementation of countermeasures against the Bleichenbacher attack for RSA-based cipher suites. An attacker could send crafted TLS messages, enabling a chosen-ciphertext attack and potential decryption of previously captured TLS sessions.

A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked. The issue is due to insufficient URL validation when portal access rules are configured. An attacker could exploit this by accessing certain URLs on the device.

A vulnerability in the FTP inspection engine of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to bypass FTP inspection. The issue is due to ineffective flow tracking of FTP traffic. An attacker could exploit this by sending crafted FTP traffic through the device, allowing bypass of inspection and successful FTP connections.

A vulnerability in the Clientless SSL VPN (WebVPN) of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in responses. The issue is due to improper input sanitization. An attacker could exploit this by persuading a user to click a crafted link, enabling CRLF injection and redirecting users to arbitrary websites.

A vulnerability in the SSL VPN negotiation process for Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The issue is due to inefficient DMA memory management during SSL VPN negotiation.

A vulnerability in the IP fragment-handling implementation of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. This memory leak could prevent traffic from being processed, resulting in a denial of service (DoS) condition. The issue is due to improper error handling during IP fragment reassembly.