Cisco ASA appliances at risk of denial of service exploit

The Australian Cyber Security Centre (ACSC) has issued an official alert to those who use Cisco's Adaptive Security Appliance (ASA), after a proof of concept showed that the devices are vulnerable to a denial of service attack.

The original vulnerability (CVE-2018-0101) was found at the end of January, however by February 7 Cisco had uncovered more potential attack vectors.

According to Cisco, a vulnerability in its ASA software could allow an unauthenticated and remote attacker to cause a system reload or to remotely execute code.

The ASA could also potentially stop processing VPN authentication requests due to low memory.

"To be vulnerable the ASA must have Secure Socket Layer (SSL) services or IKEv2 Remote Access VPN services enabled on an interface. The risk of the vulnerability being exploited also depends on the accessibility of the interface to the attacker," Cisco says.

The cause is due to a memory allocation and freeing issue during malicious XML payload processing.

Cisco explains in more detail:

"An attacker could exploit this vulnerability by sending a crafted XML packet to a vulnerable interface on an affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, cause a reload of the affected device or stop processing of incoming VPN authentication requests.

The ACSC adds that the publicised proof of concept code results in a denial of service condition – but that code will likely evolve into code that can achieve remote code execution.

Cisco has already identified 'attempted malicious use of the vulnerability' in the wild although it is unknown whether this refers to witnessing remote code execution or a denial of service condition," the ACSC says in an alert.

The ACSC recommends that organisations with affected devices patch as soon as possible. Cisco adds that it has released software updates to address the vulnerability, but there are currently 'no workarounds that address all the features that are affected by this vulnerability'.

Cisco ASA software running on the following products are all vulnerable:

- 3000 Series Industrial Security Appliance (ISA) - ASA 5500 Series Adaptive Security Appliances - ASA 5500-X Series Next-Generation Firewalls - ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers - ASA 1000V Cloud Firewall - Adaptive Security Virtual Appliance (ASAv) - Firepower 2100 Series Security Appliance - Firepower 4110 Security Appliance - Firepower 4120 Security Appliance - Firepower 4140 Security Appliance - Firepower 4150 Security Appliance - Firepower 9300 ASA Security Module - Firepower Threat Defense Software (FTD) - FTD Virtual