CVE-2017-6752 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) 9.3(3) and 9.6(2) could allow an unauthenticated, remote attacker to determine valid usernames. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to the interaction between Lightweight Directory Access Protocol (LDAP) and SSL Connection Profile when they are configured together. An attacker could exploit the vulnerability by performing a username enumeration attack to the IP address of the device. An exploit could allow the attacker to determine valid usernames. Cisco Bug IDs: CSCvd47888.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Cisco	Adaptive Security Appliance Software	9.3.3

Related Weaknesses (CWE)

CWE-200

References

http://www.securityfocus.com/bid/100113Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039057Third Party AdvisoryVDB Entry
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvd47888Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
http://www.securityfocus.com/bid/100113Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039057Third Party AdvisoryVDB Entry
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvd47888Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory

FAQ

What is CVE-2017-6752?

CVE-2017-6752 is a vulnerability with a CVSS score of 7.5 (HIGH). A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) 9.3(3) and 9.6(2) could allow an unauthenticated, remote attacker to determine valid usernames. The attacker could u...

How severe is CVE-2017-6752?

CVE-2017-6752 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-6752?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Adaptive Security Appliance Software.