8.6

CVE-2019-12678

A vulnerability in the Session Initiation Protocol (SIP) inspection module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper parsing of SIP messages. An attacker could exploit this vulnerability by sending a malicious SIP packet through an affected device. A successful exploit could allow the attacker to trigger an integer underflow, causing the software to try to read unmapped memory and resulting in a crash.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Adaptive Security Appliance Version < 9.4.4.37
   Cisco ≫ Asa 5505 Version-
   Cisco ≫ Asa 5510 Version-
   Cisco ≫ Asa 5512-x Version-
   Cisco ≫ Asa 5515-x Version-
   Cisco ≫ Asa 5520 Version-
   Cisco ≫ Asa 5525-x Version-
   Cisco ≫ Asa 5550 Version-
   Cisco ≫ Asa 5555-x Version-
   Cisco ≫ Asa 5580 Version-
   Cisco ≫ Asa 5585-x Version-
Cisco ≫ Adaptive Security Appliance Software Version >= 9.5 < 9.6.4.34
   Cisco ≫ Asa 5505 Version-
   Cisco ≫ Asa 5510 Version-
   Cisco ≫ Asa 5512-x Version-
   Cisco ≫ Asa 5515-x Version-
   Cisco ≫ Asa 5520 Version-
   Cisco ≫ Asa 5525-x Version-
   Cisco ≫ Asa 5550 Version-
   Cisco ≫ Asa 5555-x Version-
   Cisco ≫ Asa 5580 Version-
   Cisco ≫ Asa 5585-x Version-
Cisco ≫ Adaptive Security Appliance Software Version >= 9.7 < 9.8.4.7
   Cisco ≫ Asa 5505 Version-
   Cisco ≫ Asa 5510 Version-
   Cisco ≫ Asa 5512-x Version-
   Cisco ≫ Asa 5515-x Version-
   Cisco ≫ Asa 5520 Version-
   Cisco ≫ Asa 5525-x Version-
   Cisco ≫ Asa 5550 Version-
   Cisco ≫ Asa 5555-x Version-
   Cisco ≫ Asa 5580 Version-
   Cisco ≫ Asa 5585-x Version-
Cisco ≫ Adaptive Security Appliance Software Version >= 9.9 < 9.9.2.56
   Cisco ≫ Asa 5505 Version-
   Cisco ≫ Asa 5510 Version-
   Cisco ≫ Asa 5512-x Version-
   Cisco ≫ Asa 5515-x Version-
   Cisco ≫ Asa 5520 Version-
   Cisco ≫ Asa 5525-x Version-
   Cisco ≫ Asa 5550 Version-
   Cisco ≫ Asa 5555-x Version-
   Cisco ≫ Asa 5580 Version-
   Cisco ≫ Asa 5585-x Version-
Cisco ≫ Adaptive Security Appliance Software Version >= 9.10 < 9.10.1.27
   Cisco ≫ Asa 5505 Version-
   Cisco ≫ Asa 5510 Version-
   Cisco ≫ Asa 5512-x Version-
   Cisco ≫ Asa 5515-x Version-
   Cisco ≫ Asa 5520 Version-
   Cisco ≫ Asa 5525-x Version-
   Cisco ≫ Asa 5550 Version-
   Cisco ≫ Asa 5555-x Version-
   Cisco ≫ Asa 5580 Version-
   Cisco ≫ Asa 5585-x Version-
Cisco ≫ Adaptive Security Appliance Software Version >= 9.12 < 9.12.2.1
   Cisco ≫ Asa 5505 Version-
   Cisco ≫ Asa 5510 Version-
   Cisco ≫ Asa 5512-x Version-
   Cisco ≫ Asa 5515-x Version-
   Cisco ≫ Asa 5520 Version-
   Cisco ≫ Asa 5525-x Version-
   Cisco ≫ Asa 5550 Version-
   Cisco ≫ Asa 5555-x Version-
   Cisco ≫ Asa 5580 Version-
   Cisco ≫ Asa 5585-x Version-
Cisco ≫ Firepower Threat Defense Version < 6.2.3.15
Cisco ≫ Firepower Threat Defense Version >= 6.3.0 < 6.3.0.4
Cisco ≫ Firepower Threat Defense Version >= 6.4.0 < 6.4.0.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.92% 0.737
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
psirt@cisco.com 8.6 3.9 4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE-191 Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.