Security Alert (A16-10-05): Multiple Vulnerabilities in Cisco Products

Description:

Cisco has released three security advisories fixing a number of vulnerabilities in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower System Software. A remote attacker could exploit the vulnerabilities by sending a crafted NetBIOS packet, a crafted enrollment request or a crafted HTTP packet stream to the affected system.

Affected Systems:

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower System Software 

The complete list of vulnerable systems can be found in the "Affected Products" section of individual Cisco Security Advisory available at:

01. Cisco ASA Software Identity Firewall Feature Buffer Overflow Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-asa-idfw

02. Cisco ASA Software Local Certificate Authority Denial of Service Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-asa-ca

03. Cisco Firepower Detection Engine HTTP Denial of Service Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-fpsnort

Impact:

Depending on the vulnerability exploited, a successful attack could cause arbitrary code execution, denial-of-service condition, reload or take control of a vulnerable device.

Recommendation:

Patches for affected systems are now available. Users of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk. For detailed information of the available patches, please refer to the section "Fixed Software" of corresponding security advisory at vendor's website.

Users should contact their product support vendors for the fixes and assistance.

More Information:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-asa-ca
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-asa-idfw
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-fpsnort
https://www.us-cert.gov/ncas/current-activity/2016/10/19/Cisco-Releases-Security-Updates
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6431
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6432
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6439