Security News > 2020 > May > Cisco Patches High Severity Vulnerabilities in Security Products
Cisco this week released security updates to address more than 30 vulnerabilities in various products, including 12 high severity flaws impacting Adaptive Security Appliance and Firepower Threat Defense.
The most important of these issues is tracked as CVE-2020-3187 and could be exploited to conduct directory traversal attacks and then read or delete sensitive files on a vulnerable system.
"The attacker can only view and delete files within the web services file system. This file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system files," Cisco explains.
Cisco has released software updates that fix the vulnerability: ASA Software Releases 9.6.4.40, 9.8.4.15, 9.9.2.66, 9.10.1.37, 9.12.3.2, and 9.13.1.7; and FTD Software Release 6.4.0.8 and 6.5.0.4.
These flaws include XML parsing, carriage return line feed injection, disabling of user accounts, SSL/TLS URL category bypass, bypass of configured file policies, open redirect, signature checks bypass, XML external expansion, shell access, denial of service, information disclosure, access list bypass, cross-site scripting, static credential, arbitrary file overwrite, and arbitrary log file write issues.
News URL
Related news
- Researchers Uncover Major Security Vulnerabilities in Industrial MMS Protocol Libraries (source)
- CISA Warns of Critical Fortinet Flaw as Palo Alto and Cisco Issue Urgent Security Patches (source)
- The Rise of Zero-Day Vulnerabilities: Why Traditional Security Solutions Fall Short (source)
- Exploited: Cisco, SharePoint, Chrome vulnerabilities (source)
- HPE Issues Critical Security Patches for Aruba Access Point Vulnerabilities (source)
- Decades-Old Security Vulnerabilities Found in Ubuntu's Needrestart Package (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-05-06 | CVE-2020-3187 | Path Traversal vulnerability in Cisco products A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted system. | 9.1 |