Vulnerabilities > CVE-2019-12693 - Incorrect Type Conversion or Cast vulnerability in Cisco Adaptive Security Appliance
Attack vector
NETWORK Attack complexity
LOW Privileges required
HIGH Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
A vulnerability in the Secure Copy (SCP) feature of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to the use of an incorrect data type for a length variable. An attacker could exploit this vulnerability by initiating the transfer of a large file to an affected device via SCP. To exploit this vulnerability, the attacker would need to have valid privilege level 15 credentials on the affected device. A successful exploit could allow the attacker to cause the length variable to roll over, which could cause the affected device to crash.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
| NASL family | CISCO |
| NASL id | CISCO-SA-20191002-ASA-SCP-DOS.NASL |
| description | According to its self-reported version, Cisco Adaptive Security Appliance (ASA) Software is affected by a denial of service (DoS) vulnerability. This vulnerability exists in the Secure Copy (SCP) feature due to the use of an incorrect data type for a length variable. An authenticated, remote attacker can exploit this by initiating the transfer of a large file to an affected device via SCP, provided the attacker has valid privilege level 15 credentials on the affected device. This would cause the length variable to roll over, causing the system to stop responding. Please see the included Cisco BIDs and Cisco Security Advisory for more information. Note that Nessus has not tested for this issue but has instead relied only on the application |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 130090 |
| published | 2019-10-21 |
| reporter | This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/130090 |
| title | Cisco Adaptive Security Appliance Software Secure Copy DoS (cisco-sa-20191002-asa-scp-dos) |