CVE-2020-3373: 
Cisco Adaptive Security Appliance (ASA) vulnerability analysis and mitigation

A vulnerability (CVE-2020-3373) was discovered in the IP fragment-handling implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. The vulnerability was disclosed on October 21, 2020, and affects multiple versions of Cisco ASA and FTD software (NVD, Cisco ERP).

The vulnerability is classified as a memory leak issue in the IP fragment handling implementation. It has been assigned a CWE-400 classification, indicating it is related to uncontrolled resource consumption (NVD CNA). The affected versions include Cisco ASA versions 9.10.x prior to 9.10.1.44, 9.12.x prior to 9.12.4.4, 9.13.x prior to 9.13.1.13, 9.14.x prior to 9.14.1.30, 9.7.x and 9.8.x prior to 9.8.4.29, 9.9.x prior to 9.9.2.80, and versions prior to 9.6.4.45 (CERT-FR).

When exploited, this vulnerability could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition (Threatpost).

The vulnerability can be exploited by an unauthenticated, remote attacker. As of the disclosure date, Cisco's Product Security Incident Response Team was not aware of any public announcements or malicious use of this vulnerability (Threatpost).

Cisco has released software updates that address this vulnerability. Users are advised to upgrade to the fixed versions: ASA 9.10.1.44, 9.12.4.4, 9.13.1.13, 9.14.1.30, 9.8.4.29, 9.9.2.80, or 9.6.4.45 depending on their current version (CERT-FR).