Posts Tagged ‘Clientless VPN’

Monday, March 19, 2012 @ 02:03 PM gHale

Cisco has a critical vulnerability in its ASA 5500 Series Adaptive Security Appliances (ASA) an attacker could exploit remotely to execute arbitrary code and compromise a victim’s system.

The problem is in a Cisco port forwarding ActiveX control – distributed to client systems by ASA as part of the Clientless VPN feature – that can cause a buffer overflow.

RELATED STORIES
Embedded Systems Still Unprotected
Patched Hole Doesn’t Stop Attackers
Malware Shifts from Safe to Malicious
Malware Strains Meld by Accident

For an attack to be successful, a victim must first visit a specially crafted web page in Internet Explorer or another web browser that supports ActiveX technologies. Versions 7.1 and 7.2, as well as 8.0 to 8.6 of the Cisco ASA software suffer from the issue.

Cisco contacted Microsoft and requested a global kill bit for the vulnerable control in a future update, which will disable the exploitable control on affected systems.

The company has released software updates that address the issue; for those who can’t yet upgrade, workarounds are in the Cisco security advisory.

Further updates from Cisco fix multiple denial-of-service (DoS) vulnerabilities in ASA 5500 Series appliances and the Catalyst 6500 Series ASA Services Module (ASASM). The company also closed another Protocol Independent Multicast (PIM) DoS hole in the Catalyst 6500 Series Firewall Services Module (FWSM).

 
 
Archived Entries