Vulnerability In Crypto Library - Cisco Systems

This script is (C) 2010-2014 Tenable Network Security, Inc.

Synopsis :

The remote device is missing a vendor-supplied security patch.

Description :

A vulnerability has been discovered in a third-party cryptographic
library that is used by a number of Cisco products. This vulnerability
may be triggered when a malformed Abstract Syntax Notation One (ASN.1)
object is parsed. Due to the nature of the vulnerability it may be
possible, in some cases, to trigger this vulnerability without a valid
certificate or valid application-layer credentials (such as a valid
username or password). Successful, repeated exploitation of any of
these vulnerabilities may lead to a sustained denial of service (DoS)

however, vulnerabilities are not known to compromise either the
confidentiality or integrity of the data or the device. These
vulnerabilities are not believed to allow an attacker to decrypt any
previously encrypted information. Cisco has made free software
available to address this vulnerability for affected customers. There
are no workarounds available to mitigate the effects of the

See also :

Solution :

Apply the relevant patch referenced in Cisco Security Advisory

Risk factor :

Medium / CVSS Base Score : 5.0
CVSS Temporal Score : 4.1
Public Exploit Available : true

Family: CISCO

Nessus Plugin ID: 49004 (cisco-sa-20070522-crypto.nasl)

Bugtraq ID: 24104

CVE ID: CVE-2006-3894

Ready to Scan Unlimited IPs & Run Compliance Checks?

Upgrade to Nessus Professional today!

Buy Now

Combine the Power of Nessus with the Ease of Cloud

Start your free Nessus Cloud trial now!

Begin Free Trial