----------------------------------------------------------------------


Public Beta of CSI and WSUS Integration
http://secunia.com/blog/74


----------------------------------------------------------------------

TITLE:
Cisco ASA 5500 Series Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA38618

VERIFY ADVISORY:
http://secunia.com/advisories/38618/

DESCRIPTION:
Some vulnerabilities have been reported in Cisco ASA (Adaptive
Security Appliance) 5500 Series, which can be exploited by malicious
people to bypass certain security restrictions or cause a DoS (Denial
of Service). 

1) An error when receiving certain TCP segments while a connection is
being terminated can be exploited to make a device unable to accept
new TCP connections.

2) Two errors in the Session Initiation Protocol (SIP) inspection
feature can be exploited to trigger an appliance reload.

3) An error in the Skinny Client Control Protocol (SCCP) inspection
feature can be exploited to trigger an appliance reload.

4) An error in WebVPN  can be exploited to trigger an appliance
reload via a specially crafted DTLS packet.

5) An error when using the "nailed" option can be exploited to reload
an appliance via a specially crafted TCP segment that transits the
appliance.

6) An error when parsing Internet Key Exchange (IKE) messages can be
exploited to disrupt all IPsec tunnels that terminate on an affected
device.

7) An error in the implementation of the NT LAN Manager version 1
(NTLMv1) protocol can be exploited to bypass authentication via a
specially crafted username.

SOLUTION:
Update to a fixed version. Please see the vendor's advisory for
detailed patch information.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20100217-asa.shtml

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------