Story image

Cisco ASA appliances at risk of denial of service exploit

13 Feb 2018

The Australian Cyber Security Centre (ACSC) has issued an official alert to those who use Cisco’s Adaptive Security Appliance (ASA), after a proof of concept showed that the devices are vulnerable to a denial of service attack.

The original vulnerability (CVE-2018-0101) was found at the end of January, however by February 7 Cisco had uncovered more potential attack vectors.

According to Cisco, a vulnerability in its ASA software could allow an unauthenticated and remote attacker to cause a system reload or to remotely execute code.

The ASA could also potentially stop processing VPN authentication requests due to low memory.

“To be vulnerable the ASA must have Secure Socket Layer (SSL) services or IKEv2 Remote Access VPN services enabled on an interface. The risk of the vulnerability being exploited also depends on the accessibility of the interface to the attacker,” Cisco says.

The cause is due to a memory allocation and freeing issue during malicious XML payload processing.

Cisco explains in more detail:

“An attacker could exploit this vulnerability by sending a crafted XML packet to a vulnerable interface on an affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, cause a reload of the affected device or stop processing of incoming VPN authentication requests.”

The ACSC adds that the publicised proof of concept code results in a denial of service condition – but that code will likely evolve into code that can achieve remote code execution.

Cisco has already identified 'attempted malicious use of the vulnerability' in the wild although it is unknown whether this refers to witnessing remote code execution or a denial of service condition,” the ACSC says in an alert.

The ACSC recommends that organisations with affected devices patch as soon as possible. Cisco adds that it has released software updates to address the vulnerability, but there are currently ‘no workarounds that address all the features that are affected by this vulnerability’.

Cisco ASA software running on the following products are all vulnerable:

- 3000 Series Industrial Security Appliance (ISA) - ASA 5500 Series Adaptive Security Appliances - ASA 5500-X Series Next-Generation Firewalls - ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers - ASA 1000V Cloud Firewall - Adaptive Security Virtual Appliance (ASAv) - Firepower 2100 Series Security Appliance - Firepower 4110 Security Appliance - Firepower 4120 Security Appliance - Firepower 4140 Security Appliance - Firepower 4150 Security Appliance - Firepower 9300 ASA Security Module - Firepower Threat Defense Software (FTD) - FTD Virtual

Kiwis know security is important, but they're not doing much about it
Only 49% of respondents use antivirus software and even fewer – just 19% -  change their passwords regularly.
Avi Networks: Using visibility to build trust
Visibility, also referred to as observability, is a core tenet of modern application architectures for basic operation, not just for security.
Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Myth-busting assumptions about identity governance - SailPoint
The identity governance space has evolved and matured over the past 10 years, changing with the world around it.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.