CSCva38556 / CVE ID CVE-2016-6461 Known Fixed Releases?

[zshahabr1]

In the bug search page, below known fixed releases list can be seen. However, the current version that are available are nowhere near the version stated. Anyone can verify this? Thanks

Known Fixed Releases:

(7)

100.11(0.75)

100.15(0.137)

100.8(40.129)

96.2(0.95)

97.1(0.55)

97.1(12.7)

97.1(6.30)

[cinexorone]

Can anyone tell what is the last release affected by this bug and if all previous version are also affected?

thanks in advance

[SKansal]

Upon research I found that all available versions <=9.1(7.11) are affected since the fix will be on 9.1(7.12) (to be released in December).

[gduvall]

Can you document this? If not, I cannot present it to my boss as reasoning.

[Difan Zhao]

I have the same question. Those "fixed" versions don't make sense to me. I am running 9.2(3). Is this one affected? Thanks

[JeffHauff]

Bingo.. I have the same issue.. We run different versions of code and there is nothing stating if any of the 9.2 or .3 or .4 code is vulnerable.

I have to deal with this every month, I wish Cisco would make it easier for us to know what security vulnerabilities are discovered and what code is affected. 

Our rules state we have 35 days from the day the CVE is released to evaluate if we are affected.  Kind of hard to meet that expectation if you don't have the information.

The IOS Checker tool would be great if they would expand it to include all low vulnerabilities and to include the firewall code versions. 

[gduvall]

Secure Works regurgitated this bug to us with an indication they were going to be updating our firewalls to 9.1(7)12 even though we are already running 9.4(3)11.

I can't make heads or tails of this release OR the fixed releases and plan on doing nothing until someone corrects this bungled mess.

[Difan Zhao]

Yup. We got the exactly the same notice from secure works.

[lewislampkin]

Update: 

9.5(3)6 was released on the 13th of December, it contains the fix for Bug CSCva38556, for the -x series models of the ASA:

http://www.cisco.com/web/software/280775065/135839/ASA-953-Interim-Release-Notes.html

(So, like others, I am confused why this version wasn't listed as "affected" by the bug, if it is going to receive the "fix" for the bug. )

I re-check the bug to be sure, on 12/15/2016 (today), and it only lists 9.1(6)10 as a known  affected release. (if so, then why is 9.5(3) receiving a "fix"?)

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCva38556

[lewislampkin]

Update: 9.17(12) was released on 12/21/2016.

It resolves the issue for the X-series as well as the older series devices.

Revision:  Version 9.1(7)12 – 12/21/2016

Files:  asa917-12-smp-k8.bin, asa917-12-k8.bin

Defects resolved since 9.1(7)11:

CSCva38556

Cisco ASA Input Validation File Injection Vulnerability

http://www.cisco.com/web/software/280775065/131523/ASA-917-Interim-Release-Notes.html

Description:	Cisco Adaptive Security Appliance Software for the ASA 5505, 5510, 5520, 5540, and ASA5550. Please read the Release Note prior to downloading this release.
Release:	9.1.7 Interim
Release Date:	21/Dec/2016
File Name:	asa917-12-k8.bin
Size:	26.42 MB (27703296 bytes)
MD5 Checksum:	83cb9af376e5016fbcf8023c5c867335
SHA512 Checksum:	50b892a4ae28d9c099c67210d4e5d0ff1dc1ee7534c7853111dcb3ee20d3c5f317d29097edf6b4d36139226738009b0760d6c391a182fb8bd4ca20010e9b1ad3

Description:	Cisco Adaptive Security Appliance Software for the ASA 5512-x, 5515-x, 5525-x, 5545-x, 5555-x, 5580, 5585-x, and ASASM. Please read the Release Note prior to downloading this release.
Release:	9.1.7 Interim
Release Date:	21/Dec/2016
File Name:	asa917-12-smp-k8.bin
Size:	36.84 MB (38633472 bytes)
MD5 Checksum:	aa279845c795d9ec728577405f44a744
SHA512 Checksum:	ed1bf84e8b7df2383c61a86e184aaa741b18a901895e794902d0eb770acf0f7d7187309d18955f3a243c1d572867308481f79b966579e713f52ff1381450707f

Hope this helps. :/

[JeffHauff]

Thanks Lewis, (lewislampkin)

That's great, but what about all of the other 9.x code versions for the ASA X model appliances?

Its EXTREMELY difficult to justify going to a zero day upgrade especially if its a more than a slight minor upgrade.  9.1(7)11 to 9.1(7)12 upgrade is easy...  9.2(4) to 9.5(3)6 is a pretty good jump in terms of the number of potential bugs introduced.  

Please elaborate on all of the currently recommended version levels of 9.x code for the X firewalls.

Thanks

Jeff

[lewislampkin]

Jeff:

Good morning.

You are requesting more than I can deliver at this time.

I'm not a Cisco employee, contractor, or insider. I am just another member of these forums who is just as curious about this bug and curious about the proper bug fixes as you are. I am not privy to any additional information on this issue.

With regards to your recent request:

"That's great, but what about all of the other 9.x code versions for the ASA X model appliances? ...Please elaborate on all of the currently recommended version levels of 9.x code for the X firewalls."

Based on the fact that I am not a Cisco employee, contractor, or insider, I'm definitely not in a position to recommend any particular software version. I apologize, but I do not have the information that you are requesting, and I don't know anyone who might provide it. (It would be nice if a Cisco employee came into this thread and straightened out all the confusion.)

Unfortunately, as poster gduvall stated, this is a "bungled mess".

If I was in charge, I would include two things to make bug info great again:

(1) Complete list of affected code versions

(2) Release dates for all suggested upgrades. 

This way, customers like us could plan properly, as to whether they want to wait for that certain version, or go through the upgrade risk to an alternative image, or in more extreme cases, discontinue usage of said product. For example, if I'm running 9.2, but the upgrade for 9.2 won't be out until April of 2017, maybe I would consider doing the upgrade to 9.5.

[JeffHauff]

Oh sorry, for some reason I thought you were a Cisco employee....  my apologies.

Anyone know how to tag Cisco to weigh in here?