CVE-2007-2464 - Vulnerability Details - OpenCVE

Race condition in Cisco Adaptive Security Appliance (ASA) and PIX 7.1 before 7.1(2)49 and 7.2 before 7.2(2)19, when using "clientless SSL VPNs," allows remote attackers to cause a denial of service (device reload) via "non-standard SSL sessions."

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cisco	Adaptive Security Appliance Software Pix

Configuration 1 [-]

OR	cpe:2.3:h:cisco:pix::::::::
	cpe:2.3:h:cisco:pix:7.1:::::::*
	cpe:2.3:o:cisco:adaptive_security_appliance_software::::::::
	cpe:2.3:o:cisco:adaptive_security_appliance_software:7.1:::::::*

No data.

References

Link	Providers
http://secunia.com/advisories/25109
http://www.cisco.com/en/US/products/products_security_advisory09186a0080833166.shtml
http://www.kb.cert.org/vuls/id/337508
http://www.osvdb.org/35333
http://www.securityfocus.com/bid/23768
http://www.vupen.com/english/advisories/2007/1636
https://exchange.xforce.ibmcloud.com/vulnerabilities/34023

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-05-02T22:00:00

Updated: 2024-08-07T13:42:32.533Z

Reserved: 2007-05-02T00:00:00

Link: CVE-2007-2464

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2007-05-02T22:19:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-2464

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-05-02T00:00:00", "descriptions": [{"lang": "en", "value": "Race condition in Cisco Adaptive Security Appliance (ASA) and PIX 7.1 before 7.1(2)49 and 7.2 before 7.2(2)19, when using \"clientless SSL VPNs,\" allows remote attackers to cause a denial of service (device reload) via \"non-standard SSL sessions.\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20070502 LDAP and VPN Vulnerabilities in PIX and ASA Appliances", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080833166.shtml"}, {"name": "cisco-asa-ssl-vpn-dos(34023)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34023"}, {"name": "ADV-2007-1636", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/1636"}, {"name": "23768", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/23768"}, {"name": "25109", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/25109"}, {"name": "35333", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/35333"}, {"name": "VU#337508", "tags": ["third-party-advisory", "x_refsource_CERT-VN"], "url": "http://www.kb.cert.org/vuls/id/337508"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-2464", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Race condition in Cisco Adaptive Security Appliance (ASA) and PIX 7.1 before 7.1(2)49 and 7.2 before 7.2(2)19, when using \"clientless SSL VPNs,\" allows remote attackers to cause a denial of service (device reload) via \"non-standard SSL sessions.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20070502 LDAP and VPN Vulnerabilities in PIX and ASA Appliances", "refsource": "CISCO", "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080833166.shtml"}, {"name": "cisco-asa-ssl-vpn-dos(34023)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34023"}, {"name": "ADV-2007-1636", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/1636"}, {"name": "23768", "refsource": "BID", "url": "http://www.securityfocus.com/bid/23768"}, {"name": "25109", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/25109"}, {"name": "35333", "refsource": "OSVDB", "url": "http://www.osvdb.org/35333"}, {"name": "VU#337508", "refsource": "CERT-VN", "url": "http://www.kb.cert.org/vuls/id/337508"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T13:42:32.533Z"}, "title": "CVE Program Container", "references": [{"name": "20070502 LDAP and VPN Vulnerabilities in PIX and ASA Appliances", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080833166.shtml"}, {"name": "cisco-asa-ssl-vpn-dos(34023)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34023"}, {"name": "ADV-2007-1636", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/1636"}, {"name": "23768", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/23768"}, {"name": "25109", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/25109"}, {"name": "35333", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/35333"}, {"name": "VU#337508", "tags": ["third-party-advisory", "x_refsource_CERT-VN", "x_transferred"], "url": "http://www.kb.cert.org/vuls/id/337508"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-2464", "datePublished": "2007-05-02T22:00:00", "dateReserved": "2007-05-02T00:00:00", "dateUpdated": "2024-08-07T13:42:32.533Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:pix:*:*:*:*:*:*:*:*", "matchCriteriaId": "36B51668-5055-4B10-9E0F-D25C470C9A80", "versionEndIncluding": "7.2", "vulnerable": true}, {"criteria": "cpe:2.3:h:cisco:pix:7.1:*:*:*:*:*:*:*", "matchCriteriaId": "C4991BC7-B07D-4D8C-885C-136AD9D4E209", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:*", "matchCriteriaId": "051F79C8-3058-4926-A533-73F5A269599E", "versionEndIncluding": "7.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:cisco:adaptive_security_appliance_software:7.1:*:*:*:*:*:*:*", "matchCriteriaId": "5E623855-FB2B-4B8A-85E8-B8DC29A3FBB0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Race condition in Cisco Adaptive Security Appliance (ASA) and PIX 7.1 before 7.1(2)49 and 7.2 before 7.2(2)19, when using \"clientless SSL VPNs,\" allows remote attackers to cause a denial of service (device reload) via \"non-standard SSL sessions.\""}, {"lang": "es", "value": "Condici\u00f3n de carrera en el Cisco Adaptive Security Appliance (ASA) y en el PIX 7.1 anterior al 7.1(2)49 y el 7.2 anterior al 7.2(2)19, cuando se utiliza \"VPNs SSL sin cliente\", permite a atacantes remotos provocar una denegaci\u00f3n de servicio (recargar el dispositivo) a trav\u00e9s de \"sesiones SSL no est\u00e1ndar\"."}], "evaluatorSolution": "The vendor has addressed this issue with a product update. Information can be found at: http://www.cisco.com/en/US/products/products_security_advisory09186a0080833166.shtml", "id": "CVE-2007-2464", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.1, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-05-02T22:19:00.000", "references": [{"source": "cve@mitre.org", "url": "http://secunia.com/advisories/25109"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080833166.shtml"}, {"source": "cve@mitre.org", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/337508"}, {"source": "cve@mitre.org", "url": "http://www.osvdb.org/35333"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/23768"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/1636"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34023"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/25109"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080833166.shtml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.kb.cert.org/vuls/id/337508"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/35333"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/23768"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/1636"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34023"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}