CVE-2011-2054: A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password ...

Summary

A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper in...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cisco	asa_5500_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5500_firmware:8.4\(1\):::::::*`
cisco	asa_5510_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5510_firmware:8.4\(1\):::::::*`
cisco	asa_5512-x_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5512-x_firmware:8.4\(1\):::::::*`
cisco	asa_5515-x_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5515-x_firmware:8.4\(1\):::::::*`
cisco	asa_5520_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5520_firmware:8.4\(1\):::::::*`
cisco	asa_5525-x_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5525-x_firmware:8.4\(1\):::::::*`
cisco	asa_5540_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5540_firmware:8.4\(1\):::::::*`
cisco	asa_5545-x_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5545-x_firmware:8.4\(1\):::::::*`
cisco	asa_5550_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5550_firmware:8.4\(1\):::::::*`
cisco	asa_5555-x_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5555-x_firmware:8.4\(1\):::::::*`
cisco	asa_5580_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5580_firmware:8.4\(1\):::::::*`
cisco	asa_5585-x_firmware	8.4\(1\) `cpe:2.3:o:cisco:asa_5585-x_firmware:8.4\(1\):::::::*`

Original advisory text

A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password ...

A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker must have the correct primary credentials in order to successfully exploit this vulnerability.

References

https://quickview.cloudapps.cisco.com/quickview/bug/CSCtq58884 Vendor Advisory