Cisco Family October 2024 First Round Security Update Advisory
Overview
Cisco(https://www.cisco.com) has released a security update that fixes vulnerabilities in products it has been made. Users of affected systems are advised to update to the latest version.
Affected Products
Cisco Adaptive Security Appliance (ASA) Software
Cisco Firepower Management Center
Cisco Firepower Threat Defense Software
Cisco Secure Client
Resolved Vulnerabilities
Vulnerability in Cisco Adaptive Security Appliance (ASA) Software due to lack of data validation, allowing attackers to execute commands (CVE-2024-20329, CVSS 9.9) [1]
Vulnerability in Cisco Firepower Management Center due to lack of input validation, which could allow arbitrary command execution (CVE-2024-20424, CVSS 9.9) [2]
Vulnerability in Cisco FirePower Threat Defense Software that allows access to the affected system and retrieval of sensitive information due to the existence of a static account with a hardcoded password on the affected system (CVE-2024-20412, CVSS 9.3) [3]
Vulnerability in Cisco Firepower Threat Defense Software, Cisco Adaptive Security Appliance (ASA) Software due to insufficient validation of input values, resulting in a possible denial of service (CVE-2024-20426, CVSS 8.6) [4]
Vulnerability in Cisco Adaptive Security Appliance (ASA) Software,Cisco Firepower Threat Defense Software that could cause system memory exhaustion due to lack of proper memory management for incoming SSL/TLS connections on virtual platforms (CVE-2024-20260, CVSS 8.6) [5]
Vulnerability in Cisco Adaptive Security Appliance (ASA) Software,Cisco Firepower Threat Defense Software that allows a denial of service due to improper validation of client key data after a TLS session has been established (CVE-2024-20495, CVSS 8.6) [6]
Vulnerability in Cisco Firepower Threat Defense Software that could allow Cisco FTD devices to drop network traffic due to insufficient data validation (CVE-2024-20351, CVSS 8.6) [7]
Vulnerability in Cisco Firepower Threat Defense Software, Cisco Adaptive Security Appliance (ASA) Software due to incorrect handling of certain logic, allowing a denial of service (CVE-2024-20402, CVSS 8.6) [8]
Vulnerability in Cisco Firepower Threat Defense Software,Cisco Adaptive Security Appliance (ASA) Software due to improper data validation during TLS 1.3 handshake, resulting in a possible denial of service (CVE-2024-20494, CVSS 8.6) [9]
Cisco Adaptive Security Appliance (ASA) Software,A possible denial of service vulnerability due to an issue when TLS traffic is processed in Cisco Firepower Threat Defense Software (CVE-2024-20339, CVSS 8.6) [10]
Vulnerability in Cisco Firepower Threat Defense Software due to poor memory management, resulting in repeated restarts of the snort detection engine (CVE-2024-20330, CVSS 8.6) [11]
Vulnerability in Cisco Firepower Threat Defense Software,Cisco Adaptive Security Appliance (ASA) Software due to insufficient input validation, which could cause the affected device to reload (CVE-2024-20268, CVSS 7.7) [12]
Vulnerability in Cisco Firepower Threat Defense Software,Cisco Adaptive Security Appliance (ASA) Software due to improper validation of data in HTTPS POST requests, which could result in a denial of service (CVE-2024-20408, CVSS 7.7) [13]
Vulnerability in Cisco Firepower Threat Defense Software,Cisco Adaptive Security Appliance (ASA) Software that could force users to restart the authentication process due to entropy in the authentication process (CVE-2024-20331, CVSS 6.8) [14]
Vulnerability in Cisco Firepower Management Center due to insufficient validation of user input to read the database contents of the affected device and also gain limited read access to the underlying operating system (CVE-2024-20340, CVSS 6.5) [15]
Vulnerability in Cisco Firepower Management Center to modify certain parts of the configuration due to insufficient data validation (CVE-2024-20482, CVSS 6.5) [16]
Vulnerability in Cisco Firepower Management Center, the web-based management interface does not properly validate user input, which allows users to obtain unauthorized data from the database and change the system (CVE-2024-20471 and 2 others, CVSS 6.5) [17]
Vulnerability in Cisco FirePower Management Center to read arbitrary files from the default operating system on affected devices due to insufficient validation of user input in web-based management features (CVE-2024-20379, CVSS 6.5) [18]
Vulnerability in Cisco Firepower Threat Defense Software, Cisco Adaptive Security Appliance (ASA) Software due to insufficient validation of user input values to execute arbitrary HTML or script code in the browser in the context of a web service page (CVE-2024-20341 and one other, CVSS 6.1) [19]
Vulnerability in Cisco Firepower Management Center due to lack of validation of user input, allowing arbitrary script command execution (CVE-2024-20273 and 11 others, CVSS 6.1) [20]
Vulnerability in Cisco FirePower Management Center due to lack of data validation, which could allow execution of arbitrary operating system commands on affected devices (CVE-2024-20275, CVSS 6.1) [21]
Vulnerability in Cisco Firepower Threat Defense Software, Cisco Adaptive Security Appliance (ASA) Software, when reading certain files from system flash memory, improper validation of those files could allow arbitrary code execution (CVE-2024-20485, CVSS 6.0) [22]
Vulnerability in Cisco Adaptive Security Appliance (ASA) Software,Cisco Firepower Threat Defense Software in which certain system configuration and executable files have insecure storage and privileges, allowing root access to be gained on the device (CVE-2024-20370, CVSS 6.0) [23]
Cisco Firepower Threat Defense Software,Cisco Adaptive Security Appliance (ASA) Software has a possible vulnerability due to resource exhaustion that results in a resource drain (CVE-2024-20481, CVSS 5.8) [24]
Vulnerability in Cisco Firepower Threat Defense Software,Cisco Adaptive Security Appliance (ASA) Software to bypass configured ACL rules due to insufficient handling of certain logic (CVE-2024-20299 and 1 other, CVSS 5.8) [25]
Vulnerability in Cisco Firepower Threat Defense Software due to insufficient handling of certain logic, which could allow unintended traffic to enter the network protected by the affected device (CVE-2024-20407, CVSS 5.8) [26]
Vulnerability in Cisco Firepower Threat Defense Software due to improper allocation of geolocation data, which allows geolocation-based access control policies to be bypassed and traffic successfully sent to a protected device (CVE-2024-20431, CVSS 5.8) [27] [28
Vulnerability in Cisco Firepower Management Center that alters the standard layout of documents generated by the device due to improper validation of user-supplied data (CVE-2024-20274, CVSS 5.5) [28]
Vulnerability in Cisco Adaptive Security Appliance (ASA) Software due to incorrect handling of certain logic that could exhaust available ssh resources on an affected device, resulting in new ssh connections to the device being denied (CVE-2024-20526, CVSS 5.3) [29]
Vulnerability in Cisco Adaptive Security Appliance (ASA) Software,Cisco Firepower Threat Defense Software that denied authentication for remote access ssl vpn users for several minutes due to inefficient handling of memory resources during the authentication process (CVE-2024-20493, CVSS 5.3) [30]
Vulnerability in Cisco Secure Client that could cause the Cisco Secure Client software to crash due to an integer underflow condition (CVE-2024-20474, CVSS 4.3) [31]
Vulnerability Patches
Product-specific Vulnerability Patches were made available in the October 23, 2024 update. Please refer to the ‘Affected Products’ and ‘Fixed Software’ in the product-specific information in the Referenced Sites below to apply the patches.
Referenced Sites
[1] Cisco Adaptive Security Appliance Software SSH Remote Command Injection Vulnerability
[2] Cisco Secure Firewall Management Center Software Command Injection Vulnerability
[3] Cisco Firepower Threat Defense Software for Firepower 1000, 2100, 3100, and 4200 Series Static Credential Vulnerability
[4] Cisco Adaptive Security Appliance and Firepower Threat Defense Software IKEv2 VPN Denial of Service Vulnerability
[5] Cisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service Vulnerability
[6] Cisco Adaptive Security Appliance and Firepower Threat Defense Software Remote Access VPN Denial of Service Vulnerability
[7] Cisco Firepower Threat Defense Software and Cisco FirePOWER Services TCP/IP Traffic with Snort 2 and Snort 3 Denial of Service Vulnerability
[8] Cisco Adaptive Security Appliance and Firepower Threat Defense Software SSL VPN Memory Management Denial of Service Vulnerability
[9] Cisco Adaptive Security Appliance and Firepower Threat Defense Software TLS Denial of Service Vulnerability
[10] Cisco Firepower Threat Defense Software for Firepower 2100 Series TLS Denial of Service Vulnerability
[11] Cisco Firepower Threat Defense Software for Cisco Firepower 2100 Series Appliances TCP UDP Snort 2 and Snort 3 Denial of Service Vulnerability
[12] Cisco Adaptive Security Appliance and Firepower Threat Defense Software SNMP Denial of Service Vulnerability
[13] Cisco Adaptive Security Appliance and Firepower Threat Defense Software Dynamic Access Policies Denial of Service Vulnerability
[14] Cisco Adaptive Security Appliance and Firepower Threat Defense Software Remote Access SSL VPN Authentication Targeted Denial of Service Vulnerability
[15] Cisco Secure Firewall Management Center Software SQL Injection Vulnerability
[16] Cisco Secure Firewall Management Center Privilege Escalation Vulnerability
[17] Cisco Secure Firewall Management Center Software SQL Injection Vulnerabilities
[18] Cisco Secure Firewall Management Center Software Arbitrary File Read Vulnerability
[19] Cisco Adaptive Security Appliance and Firepower Threat Defense Software VPN Web Client Services Cross-Site Scripting Vulnerabilities
[20] Cisco Secure Firewall Management Center Software Cross-Site Scripting Vulnerabilities
[21] Cisco Secure Firewall Management Center Software Cluster Backup Command Injection Vulnerability
[22] Cisco Adaptive Security Appliance and Firepower Threat Defense Software Persistent Local Code Execution Vulnerability
[23] Cisco Adaptive Security Appliance and Firepower Threat Defense Software FXOS CLI Root Privilege Escalation Vulnerability
[24] Cisco Adaptive Security Appliance and Firepower Threat Defense Software Remote Access VPN Brute Force Denial of Service Vulnerability
[25] Cisco Adaptive Security Appliance and Firepower Threat Defense Software AnyConnect Access Control List Bypass Vulnerabilities
[26] Cisco Firepower Threat Defense Software TCP Snort 3 Detection Engine Bypass Vulnerability
[27] Cisco Firepower Threat Defense Software Geolocation ACL Bypass Vulnerability
[28] Cisco Secure Firewall Management Center Software HTML Injection Vulnerability
[29] Cisco Adaptive Security Appliance Software SSH Server Resource Denial of Service Vulnerability
[30] Cisco Adaptive Security Appliance and Firepower Threat Defense Software Remote Access SSL VPN Authentication Targeted Denial of Service Vulnerability
[31] Cisco Secure Client Software Denial of Service Vulnerability