CVE-2009-1160

Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)1, 7.1 before 7.1(2)74, 7.2 before 7.2(4)9, and 8.0 before 8.0(4)5 do not properly implement the implicit deny statement, which might allow remote attackers to successfully send packets that bypass intended access restrictions, aka Bug ID CSCsq91277.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a994f6.shtml	Patch Vendor Advisory
http://www.vupen.com/english/advisories/2009/0981
http://www.securitytracker.com/id?1022017
http://secunia.com/advisories/34607
http://www.securityfocus.com/bid/34429

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:cisco:adaptive_security_appliance_5500:7.2:::::::*
	cpe:2.3:h:cisco:pix:7.2:::::::*
	cpe:2.3:h:cisco:pix:8.0:::::::*
	cpe:2.3:h:cisco:pix:7.0:::::::*
	cpe:2.3:h:cisco:pix:7.1:::::::*
	cpe:2.3:h:cisco:adaptive_security_appliance_5500:7.1:::::::*
	cpe:2.3:h:cisco:adaptive_security_appliance_5500:7.0:::::::*
	cpe:2.3:h:cisco:adaptive_security_appliance_5500:8.0:::::::*
	cpe:2.3:h:cisco:adaptive_security_appliance_5500:8.1:::::::*

Information

Published : 2009-04-09 08:08

Updated : 2009-04-27 22:39

NVD link : CVE-2009-1160

Mitre link : CVE-2009-1160

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

cisco

pix
adaptive_security_appliance_5500

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080a994f6.shtml", "name": "20090408 Multiple Vulnerabilities in Cisco ASA Adaptive Security Appliance and Cisco PIX Security Appliances", "tags": ["Patch", "Vendor Advisory"], "refsource": "CISCO"}, {"url": "http://www.vupen.com/english/advisories/2009/0981", "name": "ADV-2009-0981", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securitytracker.com/id?1022017", "name": "1022017", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/34607", "name": "34607", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/34429", "name": "34429", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)1, 7.1 before 7.1(2)74, 7.2 before 7.2(4)9, and 8.0 before 8.0(4)5 do not properly implement the implicit deny statement, which might allow remote attackers to successfully send packets that bypass intended access restrictions, aka Bug ID CSCsq91277."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2009-1160", "ASSIGNER": "psirt@cisco.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2009-04-09T15:08Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:cisco:adaptive_security_appliance_5500:7.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:cisco:pix:7.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:cisco:pix:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:cisco:pix:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:cisco:pix:7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:cisco:adaptive_security_appliance_5500:7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:cisco:adaptive_security_appliance_5500:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:cisco:adaptive_security_appliance_5500:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:h:cisco:adaptive_security_appliance_5500:8.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2009-04-28T05:39Z"}