Cisco · Adaptive Security Appliance (ASA)
CVE-2016-6366
Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability
무엇인가
Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.
CISA: A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 6월 14일
- CISA 목록에 추가됨
- 2022년 5월 24일
- 게시됨
- 2016년 8월 18일
- 심각도
- 높음 8.8 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- 88% 알려진 모든 취약점 중 상위 0.2%
- 약점 유형
- CWE-119
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(8)
- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp
- http://www.securityfocus.com/bid/92521
- https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40258.zip
- http://blogs.cisco.com/security/shadow-brokers
- http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
- https://zerosum0x0.blogspot.com/2016/09/reverse-engineering-cisco-asa-for.html
- https://www.exploit-db.com/exploits/40258/
- http://www.securitytracker.com/id/1036637
Cisco의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2024. 11. 12. | Cross-Site Scripting (XSS) | Adaptive Security Appliance (ASA) | 보통 5.4 | 23% |
| 2022. 5. 24. | CLI Remote Code Execution | Adaptive Security Appliance (ASA) | 높음 7.8 | 23% |
| 2021. 11. 3. | Denial-of-Service | Adaptive Security Appliance (ASA) | 높음 7.5 | 99.9% |
| 2026. 10. 14. | Relative Path Traversal | Secure Email Gateway | 치명적 9.8 | 2.2% |
| 2026. 9. 30. | Hex Encoding | Catalyst SD-WAN Manager | 치명적 9.8 | 39% |
| 2026. 9. 16. | Incorrect Use of Privileged APIs | Identity Services Engine | 치명적 10.0 | 76% |
| 2026. 9. 14. | SQL Injection | Secure Email Gateway | 치명적 9.8 | 30% |
| 2026. 9. 9. | Firewall Management Center Authentication Bypass Using an Alternate Path or Channel | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | 치명적 10.0 | 88% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.