—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Cisco Security Advisory: Cisco ASA Software DNS Denial of Service Vulnerability

Advisory ID: cisco-sa-20170419-asa-dns

Revision: 1.0

For Public Release: 2017 April 19 16:00 GMT

Last Updated: 2017 April 19 16:00 GMT

CVE ID(s): CVE-2017-6607

CVSS Score v(3): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

+———————————————————————

Summary
=======
A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause an affected device to reload or corrupt the information present in the device’s local DNS cache.

The vulnerability is due to a flaw in handling crafted DNS response messages. An attacker could exploit this vulnerability by triggering a DNS request from the Cisco ASA Software and replying with a crafted response. A successful exploit could cause the device to reload, resulting in a denial of service (DoS) condition or corruption of the local DNS cache information.

Note: Only traffic directed to the affected device can be used to exploit this vulnerability. This vulnerability affects Cisco ASA Software configured in routed or transparent firewall mode and single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-asa-dns [“https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-asa-dns”]

—–BEGIN PGP SIGNATURE—–

iQKBBAEBAgBrBQJY94zJZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg
SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx
NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHm2XBAArriQMW1B59VSOUHr
rJR/+aAlpJ+hSIHF7UgSazutEELZ9sn7gXkCrGEYh3EV5WtUDju1xETuQPwH/Esy
4A5FQJnNCWHjRlC/3CyunpvLCZNm8x0353FQRHB7KwMBQ9sbM+0onvlyspBHYH8U
IGPin4VmAWvoIvFqB3Lezm7+zeBuJn9v/PAWO3sbZTxkcAjJIU/Tjykt0pre4qa9
ntz7Xgv64dRCsNM1BfeK+I504ffGuogvrC33KH6chxXasZesvCsnSQLgs6K+7XGq
pkGPcCuQk3te6GqBLNlTs0jPXkfbD5OFb3K1mPP8VZEelIKCKO79iaafPpb5daiD
JyMqJqJQM5WPm+FUTS9PnHME8wmvc9Lb5IuBVfbMXnfYmO20Ax3vE+htrop2rg0p
Cy81nAoSi5wrKx6c8ZR5CPGXfKW1B+2WWIBErTJQvENhUVg719Q42gDJ+XD09qZ8
W2fNBcmkUQ8KTl5uO7RyyNEpONJ/A+6vGV7NOY9euG0yxq6GiDlrWitECb7wiYcu
MvcPjFF9i1KDNhR/9dTOR/R7dLj4iH+5tIQo1smXbRPQVqbhUrFW+kKJTFzRoRte
QYlT982veljAAWyL6U5tX7Pg+sSEiEU3/E4Qq9OoR+nGQRqZRDhxNGvSIBmhCQtl
ByXe+cCCOmiaiCtJ9VMOXk2pFsE=
=7thT
—–END PGP SIGNATURE—–

_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com