Cisco ASA Local Path Inclusion Vulnerability

Cisco ASA is prone to a local path inclusion vulnerability.

A vulnerability in the function that exports environment variables of Cisco ASA Software could allow an authenticated, local attacker to inject a malicious library and take complete control of the system. The vulnerability is due to improper setting of the LD_LIBRARY_PATH environment. An attacker could exploit this vulnerability by copying a malicious library onto the affected system's external memory and triggering a reload of the system. An exploit could allow the attacker to force the affected system to load a malicious library and access the underlying Linux OS, which could lead to a full compromise of the system.

Version 8.2, 8.3, 8.4 and 8.7

Checks if a vulnerable version is present on the target host.

Apply the appropriate updates from Cisco.