Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V,

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cisco adaptive security appliance software7.2.1 and later · before 9.0.4.40
• cisco adaptive security appliance software9.1.1 and later · before 9.1.7\(9\)
• cisco adaptive security appliance software9.2.0 and later · before 9.2.4\(14\)
• cisco adaptive security appliance software9.3.0 and later · before 9.3.3\(10\)
• cisco adaptive security appliance software9.4.0.115 and later · before 9.4.3\(8\)
• cisco adaptive security appliance software9.5.0 and later · up to 9.5\(3\) inclusive
• cisco adaptive security appliance software9.6.0 and later · before 9.6.1\(11\)

Other highest-scoring records for the same primary product.

• CVE-2000-1022The mailguard feature in Cisco Secure PIX Firewall 5.2(2) and earlier does not properly restrict access to SMTP commands, which allows remot
  32Monitor
• CVE-2002-2139Cisco PIX Firewall 6.0.3 and earlier, and 6.1.x to 6.1.3, do not delete the duplicate ISAKMP SAs for a user's VPN session, which allows loca
  25Monitor
• CVE-2002-2140Buffer overflow in Cisco PIX Firewall 5.2.x to 5.2.8, 6.0.x to 6.0.3, 6.1.x to 6.1.3, and 6.2.x to 6.2.1 allows remote attackers to cause a
  21Monitor
• CVE-2000-1027Cisco Secure PIX Firewall 5.2(2) allows remote attackers to determine the real IP address of a target FTP server by flooding the server with
  21Monitor
• CVE-1999-0158Cisco PIX firewall manager (PFM) on Windows NT allows attackers to connect to port 8080 on the PFM server and retrieve any file whose name a
  20Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.