Vulnerability CVE-2013-5511 - CERT Civis.Net

Vulnerability Name:

CVE-2013-5511 (CCN-87776)

Assigned:

2013-10-09

Published:

2013-10-09

Updated:

2016-11-01

Summary:

The Adaptive Security Device Management (ASDM) remote-management feature in Cisco Adaptive Security Appliance (ASA) Software 8.2.x before 8.2(5.46), 8.3.x before 8.3(2.39), 8.4.x before 8.4(6), 8.5.x before 8.5(1.18), 8.6.x before 8.6(1.12), 8.7.x before 8.7(1.7), 9.0.x before 9.0(3.1), and 9.1.x before 9.1(2.6) does not properly implement the authentication-certificate option, which allows remote attackers to bypass authentication via a TCP session to an ASDM interface, aka Bug ID CSCuh44815.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2013-5511

Source: CCN
Type: cisco-sa-20131009-asa
Multiple Vulnerabilities in Cisco ASA Software

Source: CISCO
Type: Vendor Advisory
20131009 Multiple Vulnerabilities in Cisco ASA Software

Source: CISCO
Type: Vendor Advisory
20131213 Digital Certificate HTTP Authentication Bypass Vulnerability

Source: CCN
Type: OSVDB ID: 98262
Cisco Adaptive Security Appliance (ASA) ASDM Crafted Certificate Authentication Bypass

Source: CCN
Type: BID-62917
Cisco Adaptive Security Appliance Software CVE-2013-5511 Authentication Bypass Vulnerability

Source: XF
Type: UNKNOWN
cisco-asa-cve20135511-sec-bypass(87776)

Vulnerable Configuration:

Configuration 1:

cpe:/a:cisco:adaptive_security_appliance_software:8.2:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2(1):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2(2):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2(3):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2(3.9):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2(4):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2(4.1):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2(4.4):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2(5):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2(5.35):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2(5.38):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2.1:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2.2:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2.2:interim:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.2.3:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.3(1):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.3(2):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.3(2.34):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.3(2.37):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.3.1:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.3.1:interim:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.3.2:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.4:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.4(1):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.4(1.11):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.4(2):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.4(2.11):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.4(3):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.4(4.11):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.4(5):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.5:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.5(1):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.5(1.4):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.5(1.17):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.6:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.6(1):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.6(1.3):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.6(1.10):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.7(1.3):*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.7.1:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:8.7.1.1:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:9.0:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:9.1:*:*:*:*:*:*:*

OR cpe:/a:cisco:adaptive_security_appliance_software:9.1(1.7):*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:cisco:adaptive_security_appliance:-:*:*:*:*:*:*:*

Denotes that component is vulnerable