A vulnerability in DNS over IPv6 packet processing for Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to unexpectedly reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper length validation of a field in an IPv6 DNS packet. An attacker could exploit this vulnerability by sending a crafted DNS query over IPv6, which traverses the affected device. An exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. This vulnerability is specific to DNS over IPv6 traffic only.

A vulnerability in DNS over IPv6 packet processing for Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to unexpectedly reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper length validation of a field in an IPv6 DNS packet. An attacker could exploit this vulnerability by sending a crafted DNS query over IPv6, which traverses the affected device. An exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. This vulnerability is specific to DNS over IPv6 traffic only.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to its self-reported version, Cisco Firepower Threat Defense (FTD) Software is affected by a denial of   service (DoS) vulnerability in IPV6 DNS packet processing component due to insufficient validation of user-supplied   input. An unauthenticated, remote attacker can exploit this issue, by sending specially crafted IPV6 DNS packets to   an affected device, to cause a denial of service condition. 

  Please see the included Cisco BIDs and Cisco Security Advisory for more information

According to its self-reported version, Cisco Adaptive Security Appliance (ASA) Software is affected by a denial of   service (DoS) vulnerability in its DNS over IPV6 implementation due to insufficient user input validation. An   unauthenticated, remote attacker can exploit this issue, by sending a specially crafted DNS IPV6 query to an affected   host, to cause a DoS condition.

  Please see the included Cisco BIDs and Cisco Security Advisory for more information.
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported   version

ID	Name	Product	Family	Type	Severity
506172	Cisco ASA Improper Input Validation (CVE-2020-3191)	Tenable OT Security	Tenable.ot	Remote	high
137662	Cisco Firepower Threat Defense (FTD) DNS Denial of Service (cisco-sa-asaftd-ipv6-67pA658k)	Nessus	CISCO	Local	high
137661	Cisco Adaptive Security Appliance (ASA) IPV6 DNS DoS (cisco-sa-asaftd-ipv6-67pA658k)	Nessus	CISCO	Local	high

Detections

Analytics

CVE-2020-3191

high

Tenable Plugins

high

high

high