Cisco Firepower Threat Defense OSPF Packets Processing Memory Leak (cisco-sa-asa-ftd-ospf-memleak-DHpsgfnv)

high Nessus Plugin ID 137559

Language:

Synopsis

The remote device is missing a vendor-supplied security patch

Description

According to its self-reported version, Firepower Threat Defense (FTD) Software is affected by a vulnerability in the Open Shortest Path First (OSPF) implementation due to incorrect processing of certain OSPF packets. An unauthenticated, remote attacker can exploit this, by sending a series of crafted OSPF packets to be processed by an affected device, in order to cause a memory leak on an affected device.

Please see the included Cisco BID and Cisco Security Advisory for more information.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvr92168

Plugin Details

Severity: High

ID: 137559

File Name: cisco-sa-asa-ftd-ospf-memleak-DHpsgfnv-ftd.nasl

Version: 1.9

Type: local

Family: CISCO

Published: 6/17/2020

Updated: 3/31/2023

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2020-3195

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:firepower_threat_defense

Required KB Items: Settings/ParanoidReport, installed_sw/Cisco Firepower Threat Defense, Host/Cisco/Firepower

Exploit Ease: No known exploits are available

Patch Publication Date: 5/6/2020

Vulnerability Publication Date: 5/6/2020

Reference Information

CVE: CVE-2020-3195

CISCO-SA: cisco-sa-asa-ftd-ospf-memleak-DHpsgfnv

IAVA: 2020-A-0205-S

CISCO-BUG-ID: CSCvr92168

Detections

Analytics