CVE-2020-3196
HighCVSS 8.6Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
A vulnerability in the SSL/TLS handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to exhaust memory resources on the affected device, leading to a DoS condition. The issue is due to improper resource management for inbound SSL/TLS connections. An attacker could exploit this by establishing multiple SSL/TLS connections with specific conditions, potentially exhausting memory and causing the device to stop accepting new SSL/TLS connections. Manual intervention is required to recover.
Risk Assessment
The risk is the potential for memory exhaustion, leading to unavailability of SSL/TLS services and requiring manual intervention to restore.
Recommendation
Update ASA/FTD software to patched versions and monitor the number of SSL/TLS connections.
Other vulnerabilities in Cisco Adaptive Security Appliance (ASA)
See all- CVE-2015-6327High
The IKEv1 implementation in Cisco Adaptive Security Appliance (ASA) software before version 8.2(5.58), 8.3, 8.4(7.29), 8.5-8.7(1.17), 9.0(4.37), 9.1(6.8), 9.2(4), and 9.3(3) allows remote attackers to cause a denial of service (device reload) via crafted ISAKMP UDP packets.
- CVE-2015-6326High
Cisco Adaptive Security Appliance (ASA) software versions 7.2 and 8.2 before 8.2(5.58), 8.3, 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.6), 9.2 before 9.2(4), 9.3 before 9.3(3.5), and 9.4 before 9.4(1.5) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response.
- CVE-2015-6325High
Cisco Adaptive Security Appliance (ASA) software versions 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.4), 9.2 before 9.2(4), 9.3 before 9.3(3.1), and 9.4 before 9.4(1.1) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response.
- CVE-2015-6324High
The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) software before versions 9.0(4.37), 9.1(6.6), 9.2(4), 9.3(3.5), and 9.4(2) is vulnerable to remote attacks that can lead to denial of service via crafted DHCPv6 packets.
- CVE-2020-3554High
A vulnerability in the TCP packet processing of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. The issue is due to a memory exhaustion condition. An attacker could exploit this by sending a high rate of crafted TCP traffic, potentially exhausting device resources and causing DoS for transiting traffic.
- CVE-2019-1694High
A vulnerability in the TCP processing engine of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a DoS condition. The issue is due to improper handling of TCP traffic. An attacker could exploit this by sending a specific sequence of packets at a high rate, potentially causing temporary traffic disruption during reboot.
- CVE-2019-1687High
A vulnerability in the TCP proxy functionality for Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause the device to restart unexpectedly, resulting in a DoS condition. The issue is due to an error in TCP-based packet inspection, which can cause an invalid Layer 2 header. An attacker could exploit this by sending a crafted TCP packet sequence.
- CVE-2018-15383High
A vulnerability in the cryptographic hardware accelerator driver of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary DoS condition. The issue exists because the devices have limited DMA memory and the software improperly handles resources in low-memory conditions. An attacker could exploit this by sending sustained high-rate malicious traffic, potentially exhausting DMA memory and causing a reload.
- CVE-2018-0228High
A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause CPU utilization to increase upwards of 100%, leading to a denial of service (DoS) condition. The issue is due to incorrect handling of an internal software lock that can prevent other system processes from getting CPU cycles. An attacker could exploit this by sending a steady stream of malicious IP packets, potentially exhausting CPU resources and causing traffic delays.
Original NVD description (English source)
A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) handler of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust memory resources on the affected device, leading to a denial of service (DoS) condition. The vulnerability is due to improper resource management for inbound SSL/TLS connections. An attacker could exploit this vulnerability by establishing multiple SSL/TLS connections with specific conditions to the affected device. A successful exploit could allow the attacker to exhaust the memory on the affected device, causing the device to stop accepting new SSL/TLS connections and resulting in a DoS condition for services on the device that process SSL/TLS traffic. Manual intervention is required to recover an affected device.