| CNNVD-ID编号 | CNNVD-201806-401 | CVE编号 | CVE-2018-0296 |
| 发布时间 | 2018-06-08 | 更新时间 | 2020-09-07 |
| 漏洞类型 | 路径遍历 | 漏洞来源 | security researcher Michal Bentkowski from Securitum .,Angelo Ruwantha |
| 危险等级 | 高危 | 威胁类型 | 远程 |
| 厂商 | cisco | ||
Cisco 3000 Series Industrial Security Appliance（ISA）等都是美国思科（Cisco）公司的安全设备。ASA Software和Firepower Threat Defense (FTD) Software都是分别运行在不同设备中的操作系统。
多款Cisco产品中的ASA Software和FTD Software的Web界面存在输入验证漏洞，该漏洞源于程序缺少对HTTP URL的正确验证。远程攻击者可通过向受影响设备发送特制的HTTP请求利用该漏洞造成拒绝服务或造成信息泄露。以下产品受到影响：Cisco 3000 Series Industrial Security Appliance (ISA)；ASA 1000V Cloud Firewall；ASA 5500 Series Adaptive Security Appliances；ASA 5500-X Series Next-Generation Firewalls；ASA Services Module for Cisco Catalyst 6500 Series Switches和Cisco 7600 Series Routers；Adaptive Security Virtual Appliance (ASAv)；Firepower 2100 Series Security Appliance；Firepower 4100 Series Security Appliance；Firepower 9300 ASA Security Module；FTD Virtual (FTDv)。
目前厂商已发布升级了多款Cisco产品ASA Software和Firepower Threat Defense Software 输入验证错误漏洞的补丁，多款Cisco产品ASA Software和Firepower Threat Defense Software 输入验证错误漏洞的补丁获取链接：
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd
来源:BID
来源:MISC
链接：https://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html
来源:MISC
来源:CONFIRM
链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd
来源:EXPLOIT-DB
来源:SECTRACK
来源:www.exploit-db.com
来源:vigilance.fr
链接：https://vigilance.fr/vulnerability/Cisco-ASA-denial-of-service-via-HTTP-URL-28680
来源:packetstormsecurity.com
链接：https://packetstormsecurity.com/files/154017/Cisco-Adaptive-Security-Appliance-Path-Traversal.html
计算
安全
数据库
网络和加速
企业服务
