Vulnerability in Cisco Asa 5500
CVE-2013-0149
The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488 does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a (1) unicast or (2) multicast packet, aka Bug IDs CSCug34485, CSCug34469, CSCug39762, CSCug63304, and CSCug39795.
EPSS: 0.025 (83.5th percentile) — read the EPSS interpretation.
Affected products
- Cisco Asa_5500 — versions 7.0, 7.1, 7.2
- Cisco Fwsm
- Cisco Ios — versions 12.1(8b)ex4, 12.0\(18\)st1, 12.1(15)bc1
- Cisco Ios_xe — versions 3.4.xs, 3.3.1sg, 3.1.0s
- Cisco Nx-os
- Cisco Pix_firewall_software — versions 8.0(2), 7.0, 7.2
- Cisco Staros — versions 14.0
- N/a — versions n/a
Public proof-of-concept exploits
References
- cret@cert.org (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
Frequently asked questions
- What is CVE-2013-0149?
- CVE-2013-0149 is a vulnerability in Cisco Asa 5500. Published 2013-08-05.
- Is CVE-2013-0149 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.