-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2011.0064
                   Multiple Vulnerabilities in Cisco ASA
                              20 January 2011

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Cisco ASA 5500 series
Publisher:         CCIRC
Operating System:  Cisco
Impact/Access:     Denial of Service        -- Remote/Unauthenticated
                   Access Confidential Data -- Remote/Unauthenticated
                   Unauthorised Access      -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2010-4692 CVE-2010-4691 CVE-2010-4690
                   CVE-2010-4689 CVE-2010-4688 CVE-2010-4682
                   CVE-2010-4681 CVE-2010-4680 CVE-2010-4679
                   CVE-2010-4678 CVE-2010-4677 CVE-2010-4676
                   CVE-2010-4675 CVE-2010-4674 CVE-2010-4673
                   CVE-2010-4672 CVE-2010-4670 CVE-2009-5037

Original Bulletin: 
   http://www.publicsafety.gc.ca/prg/em/ccirc/2011/av11-004-eng.aspx

- --------------------------BEGIN INCLUDED TEXT--------------------

Multiple Vulnerabilities in Cisco ASA

Number: AV11-004
Date: 18 January 2011

Purpose

The purpose of this advisory is to raise awareness of multiple vulnerabilities 
in Cisco ASA, for which a security patch update is now available.

Assessment

Multiple vulnerabilities exist in Cisco ASA 5500 series adaptive security 
appliances that if exploited by remote users, could cause a denial of service 
(DoS), permit access to sensitive information or bypass restrictions.

These issues are caused by errors related to SIP inspection, ACLs, Mobile User 
Security (MUS) service, multicast traffic, LAN-to-LAN (L2L) IPsec sessions, 
ASDM, Neighbour Discovery (ND), EIGRP traffic, TELNET, IPsec traffic, emWEB, 
device startup, Online Certificate Status Protocol (OCSP) connections, CIFS, 
SMTP inspection, and LDAP authentication.

Cisco Bug ID References: CSCth36592, CSCtg61810, CSCtg69742, CSCte53635, 
CSCte46460, CSCte20030, CSCtf29867, CSCte14901, CSCsz80777, CSCsz36816, 
CSCsy86769, CSCsy08416, CSCsx52748, CSCsv40504, CSCtg63992, CSCtg06316, 
CSCtf20269, CSCti24526, CSCsm11264, CSCtb92911

CVE References: CVE-2009-5037 - CVE-2010-4670 - CVE-2010-4672 - CVE-2010-4673 - 
CVE-2010-4674 - CVE-2010-4675 - CVE-2010-4676 - CVE-2010-4677 - CVE-2010-4678 - 
CVE-2010-4679 - CVE-2010-4680 - CVE-2010-4681 - CVE-2010-4682 - CVE-2010-4688 - 
CVE-2010-4689 - CVE-2010-4690 - CVE-2010-4691 - CVE-2010-4692

Affected Versions
- -----------------
Cisco ASA 5500 Series Adaptive Security Appliances versions 8.x
Suggested action

CCIRC recommends that organizations liaise with administrators of the affected 
products to assess exposure and apply vendor-recommended updates.

Note: A list of open caveats which may affect certain environments can be 
found within the Release Notes referenced below.

References
- ----------
http://www.cisco.com/en/US/docs/security/asa/asa83/release/notes/asarn83.pdf
http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.pdf
http://www.vupen.com/english/advisories/2011/0130
http://securitytracker.com/alerts/2011/Jan/1024963.html
Note to Readers

The Canadian Cyber Incident Response Centre (CCIRC) provides a focal point for 
Canada's cyber threat and vulnerability warning, analysis and response. CCIRC 
is responsible for assuring the resilience of national critical infrastructure
through monitoring threats and coordinating a federal response to cyber
security incidents of national interest. CCIRC operates in conjunction with 
the Government Operations Centre (GOC) within Public Safety Canada and is a 
key component of the government's all-hazards approach to emergency management 
and national security.

For general information, please contact Public Safety Canada's Public Affairs 
division at:

Telephone: 613-944-4875 or 1-800-830-3118
Fax: 613-998-9589
E-mail: communications@ps-sp.gc.ca

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFNN4x+/iFOrG6YcBERAnPyAJ9isK1Mvs6kbrlC7SypxHB4BkiT7QCfaBd0
4oKE8pqGbP+qUad/O8qTT/U=
=+xqr
-----END PGP SIGNATURE-----