1. 主页
  2. 保安警报
  3. 保安警报 (A21-04-12)

高危保安警报 (A21-04-12): Cisco 产品多个漏洞


 

发布日期: 2021年 4月 29日

最後更新: 2021年 6月 28日

  
  

描述:

Cisco 发布了安全公告以应对发现於 Cisco 装置及软件中的多个漏洞。有关漏洞及攻击向量的资料，请参阅供应商网站的相应安全公告。

一个针对 Cisco ASA 装置跨网址程式编程漏洞 (CVE-2020-3580) 的概念验证和可行的程式码已被公开。成功利用这个漏洞可以在受影响的系统导致执行任意手稿程式代码。系统管理员应立即为受影响的系统安装修补程式，以减低受到网络攻击的风险。

 

受影响的系统:

  • Cisco 运行 Cisco Adaptive Security Appliance (ASA) Software 的产品
  • Cisco 运行 Cisco Firepower Threat Defense (FTD) Software 的产品
  • Cisco 运行 Cisco UTD Snort IPS Engine Software 的产品
  • Cisco 运行 Cisco Firepower Management Center (FMC) Software 的产品
  • Cisco Firepower Device Manager

有关受影响产品的详细资料，请参阅供应商网站的相应安全公告中有关“Affected Products”的部分。

 

影响:

成功利用这些漏洞可以在受影响的系统导致插入任意指令码、跨网址程式编程、服务受阻断、泄漏资讯、缓衝区满溢、绕过保安限制、数据篡改或完全控制受影响的系统，视乎攻击者利用哪些漏洞而定。

 

建议:

适用於受影响系统的软件更新已可获取。受影响系统的系统管理员应遵从产品供应商的建议，立即采取行动以降低风险。有关修补程式的详细资料，请参阅供应商网站的相应安全公告中有关 “Fixed Software” 的部分。

系统管理员可联络其产品支援供应商，以取得修补程式及有关支援。

 

进一步信息:

  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-cmdinj-TKyQfDcU
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-cmd-inj-SELprvG
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-sipdos-GGwmMerC
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-vpn-dos-fpBcpEcD
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fdm-dos-nFES8xTN
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fdm-xxe-zR7sxPfs
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-iac-pZDMQ4wC
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-yT8LNSeA
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-cmdinj-vWY5wqZT
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-file-overwrite-XknRjGdB
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-ssl-decrypt-dos-DdyLuK6c
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-fp-bp-KfDdcQhc
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-memc-dos-fncTyYKG
  • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-xss-multiple-FCB3vPZe#fs
  • https://twitter.com/ptswarm/status/1408050644460650502
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3580 (to CVE-2020-3583)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1256
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1369
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1402
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1445
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1448
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1455 (to CVE-2021-1458)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1476
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1477
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1488
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1489
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1493
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1495
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1501
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1504


标签 : Cisco , Cisco ASA , Cisco FTD , Cisco FMC , Cisco UTD Snort IPS Engine , Cisco FDM
标签