Cisco Adaptive Security Appliance Identity Firewall NetBIOS Logout Probe Auth State Change Vulnerability

A vulnerability in the NetBIOS logout probe feature of the Identity Firewall (IDFW) feature of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to impact the authorization status of users authorized via this feature.

The vulnerability is due to insufficient validation of the NetBIOS probe response. An attacker could exploit this vulnerability by sending a crafted NetBIOS probe response. An exploit could allow the attacker to impact access of a currently authorized user.

Cisco has confirmed the vulnerability in a security notice; however, software updates are not available.

To exploit this vulnerability, an attacker may need access to trusted, internal networks to send a crafted NetBIOS probe response to a targeted device. This access requirement limits the possibility of a successful exploit.

Cisco indicates through the CVSS score that proof-of-concept exploit code exists; however, the code is not known to be publicly available.