CVE-2013-5509

The SSL implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0 before 9.0(2.6) and 9.1 before 9.1(2) allows remote attackers to bypass authentication, and obtain VPN access or administrative access, via a crafted X.509 client certificate, aka Bug ID CSCuf52468.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa	Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5509	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:cisco:adaptive_security_appliance_software:9.0:::::::*
	cpe:2.3:o:cisco:adaptive_security_appliance_software:9.1:::::::*

History

15 Aug 2023, 15:14

Type	Values Removed	Values Added
CPE	cpe:2.3:a:cisco:adaptive_security_appliance_software:9.0:::::::* cpe:2.3:a:cisco:adaptive_security_appliance_software:9.1:::::::*	cpe:2.3:o:cisco:adaptive_security_appliance_software:9.1:::::::* cpe:2.3:o:cisco:adaptive_security_appliance_software:9.0:::::::*

Information

Published : 2013-10-13 10:20

Updated : 2024-02-28 12:00

NVD link : CVE-2013-5509

Mitre link : CVE-2013-5509

CVE.ORG link : CVE-2013-5509

JSON object : View

Products Affected

cisco

adaptive_security_appliance_software

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2013-5509", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-10-13T10:20:04.287", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5509", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The SSL implementation in Cisco Adaptive Security Appliance (ASA) Software 9.0 before 9.0(2.6) and 9.1 before 9.1(2) allows remote attackers to bypass authentication, and obtain VPN access or administrative access, via a crafted X.509 client certificate, aka Bug ID CSCuf52468."}, {"lang": "es", "value": "La implementaci\u00f3n SSL en Cisco Adaptive Security Appliance (ASA) 9.0 anterior a 9.0(2.6) y 9.1 anterior a 9.1(2) permite a atacantes remotos sortear la autenticaci\u00f3n y obtener acceso VPN o acceso administrativo a trav\u00e9s de un certificado de cliente X.509 manipulado, tambien conocido como Bug ID CSCuf52468."}], "lastModified": "2023-08-15T15:14:43.030", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F995B807-32A2-401F-99D5-FBBA8B69E844"}, {"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B64230D9-75E1-40C0-8889-43F1035F5B60"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}