CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:S/C:P/I:N/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H
EPSS
Percentile
44.2%
According to its self-reported version, Cisco ASA Software is affected by an heap overflow condition in the handler for HTTP authentication resources accessed through the Clientless SSL VPN portal which allows an authenticated, remote attacker to cause a denial of service condition or obtain portions of process memory from the affected device.
Please see the included Cisco BIDs and Cisco Security Advisory for more information.
#TRUSTED 25ae25a0764ab0dc266b7f6bf3f71d82b51f99eacdc33d2a2085aa60e346f32676867b8babda2d544a140b52ebf504c64be8a274138c2af64bcff2f2e4330a0762b2614d5bf6f5f84ef480fe560d2b7a6b7edc5a6f333c5c360583357129a1969333ee25aed702611b5fde028aa6074433fa923017426e5cd78886d792db626263d90f2cd848a77624ddb99017b1c01e993b5781c146f6299de46c942f93315b974cbc2a22d3bed3e8cf6294a55c29d615e941af08121a6dcf171c25e453b93bea9731081f7667f906be727ab7aebb84e226924f15a8251ff7ed76707bea5f3a114abd48dba09308f7f18187d25fa1becec4493d936ea7702fa58402d7519f3b41483ca9649b55e1f7acf557f44ab8525f7a514ad2bfc6f58249377502aa74d07130a7fce2e766fde1762a8d1a941b076ad3760545a4e11491bcf5e3ad78704f68625403be992f46b984cf376dcad20b55030bfa37b493c1e0b9e71f38e2796eb3e48c0025266a1026d9191cc09678f5d00c2c9ea27989b338f2015279dc4b523bd6d4f32b9f46279089bf727b245ce05e2dbe5b610fc6668f6bf4302adc3cd38c22722f6198c6664be0dbb678e6624a0156c922bb27d189c8381d406bf7c71942f2a45d8957799dc14415b517060f56827c97a168f830d9e41176f5ad1e79703f601d5b8868a2b443148d025f4b770f9cbf183c11e7feb61e26f22dba4a3576
#TRUST-RSA-SHA256 8da5fb89da187a0369600da718e1a46c0530a4697152c4ee33a1f729defdce297a235441f7865059f01371108d737c32d296e3223b2a3d21e3ef40705e32aad194f55f68357239478ab90a0a6a0b126632e2a9f6ac0683f5317fa92052f6717b0d15c1f322f5b293f916bbf5644e27b4e3691fbe6f3cb806b68d83dc176b78e5f756b467165ae6bfce241e05ea561688669221b6b384e46f9ab7baebdcf324e314e17cfec8c6cd327acc70a35782ba56604ef9a802be872386ed221c16014191060f5843cbf1c33998b6b51208f4687e317b4b64a864e118ef0a9073f718e34a64255a2e674fedec26e7d2dcb6712064a1063bf840958ecca8c83fc974bce5190782ac1c45d74b6920bac38b99bead32f26b9c70f59971d70ca6ce32e16c7e6a72f66dbcd4d5f548d617a44aabe1adc4d25d1f0a7360023c5d2a5312cbed4467b6d63c32d726662066d75fbfc3993ae5b44b32a4f8eaf6f20d8c73a3d9b8e91dfed269406fc4472419ea96b0f4430deb57c2af723c3a1886621d989d4a9eff990078fb3bd2cfddbfca5411545b6b362f7a0b8019b4adacfd9f1b3a462f532fafbaf44f9afcdd112929f553e9a14fc0752e2dd49eeba3607258ea4e82ebc35240416d17880ecf11a3b7619f301fd6c6205b78c4ed3a9942498c0c1d67a6ef2316030a710856157c17132a9bd8d51ecf02544473c50fbdc7f15d267227a188890f
##
# (C) Tenable, Inc.
##
include('compat.inc');
if (description)
{
script_id(160479);
script_version("1.12");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/03/31");
script_cve_id("CVE-2022-20737");
script_xref(name:"CISCO-BUG-ID", value:"CSCwa33898");
script_xref(name:"CISCO-SA", value:"cisco-sa-asa-ssl-vpn-heap-zLX3FdX");
script_xref(name:"IAVA", value:"2022-A-0185-S");
script_name(english:"Cisco Adaptive Security Appliance Software Clientless SSL VPN Heap Overflow (cisco-sa-asa-ssl-vpn-heap-zLX3FdX)");
script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco ASA Software is affected by an heap overflow condition in
the handler for HTTP authentication resources accessed through the Clientless SSL VPN portal which
allows an authenticated, remote attacker to cause a denial of service condition or obtain portions of
process memory from the affected device.
Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-vpn-heap-zLX3FdX
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?71203eea");
script_set_attribute(attribute:"see_also", value:"https://tools.cisco.com/security/center/viewErp.x?alertId=ERP-74836");
script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa33898");
script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwa33898");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-20737");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_cwe_id(122);
script_set_attribute(attribute:"vuln_publication_date", value:"2022/04/27");
script_set_attribute(attribute:"patch_publication_date", value:"2022/04/27");
script_set_attribute(attribute:"plugin_publication_date", value:"2022/05/04");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:adaptive_security_appliance_software");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CISCO");
script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/Cisco/ASA/model");
exit(0);
}
include('ccf.inc');
include('cisco_workarounds.inc');
var product_info = cisco::get_product_info(name:'Cisco Adaptive Security Appliance (ASA) Software');
var vuln_ranges = [
{'min_ver': '0.0', 'fix_ver': '9.8.4.44'},
{'min_ver': '9.9', 'fix_ver': '9.12.4.38'},
{'min_ver': '9.13', 'fix_ver': '9.14.4'},
{'min_ver': '9.15', 'fix_ver': '9.15.1.21'},
{'min_ver': '9.16', 'fix_ver': '9.16.2.14'},
{'min_ver': '9.17', 'fix_ver': '9.17.1.7'}
];
var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = [
WORKAROUND_CONFIG['ssl_vpn'],
WORKAROUND_CONFIG['ssl_clientless'],
{'require_all_generic_workarounds': TRUE}
];
var reporting = make_array(
'port' , 0,
'severity', SECURITY_HOLE,
'version' , product_info['version'],
'bug_id' , 'CSCwa33898',
'cmds' , make_list('show running-config', 'show running-config all group-policy')
);
cisco::check_and_report(
product_info:product_info,
workarounds:workarounds,
workaround_params:workaround_params,
reporting:reporting,
vuln_ranges:vuln_ranges
);
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:S/C:P/I:N/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H
EPSS
Percentile
44.2%