CVE-2013-5512: cisco adaptive_security_appliance_software Race Condition

Vulnerability summary

CVE-2013-5512 is a high (CVSS 7.1) Race Condition vulnerability in cisco adaptive_security_appliance_software. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 71.9% of scored vulnerabilities.

Timeline

1. 13-10-2013
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Race condition in the HTTP Deep Packet Inspection (DPI) feature in Cisco Adaptive Security Appliance (ASA) Software 8.2.x before 8.2(5.46), 8.3.x before 8.3(2.39), 8.4.x before 8.4(5.5), 8.5.x before 8.5(1.18), 8.6.x before 8.6(1.12), 8.7.x before 8.7(1.4), 9.0.x before 9.0(1.4), and 9.1.x before 9.1(1.2), in certain conditions involving the spoof-server option or ActiveX or Java response inspection, allows remote attackers to cause a denial of service (device reload) via a crafted HTTP response, aka Bug ID CSCud37992.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.