Story image

Cisco ASA appliances at risk of denial of service exploit

13 Feb 18

The Australian Cyber Security Centre (ACSC) has issued an official alert to those who use Cisco’s Adaptive Security Appliance (ASA), after a proof of concept showed that the devices are vulnerable to a denial of service attack.

The original vulnerability (CVE-2018-0101) was found at the end of January, however by February 7 Cisco had uncovered more potential attack vectors.

According to Cisco, a vulnerability in its ASA software could allow an unauthenticated and remote attacker to cause a system reload or to remotely execute code.

The ASA could also potentially stop processing VPN authentication requests due to low memory.

“To be vulnerable the ASA must have Secure Socket Layer (SSL) services or IKEv2 Remote Access VPN services enabled on an interface. The risk of the vulnerability being exploited also depends on the accessibility of the interface to the attacker,” Cisco says.

The cause is due to a memory allocation and freeing issue during malicious XML payload processing.

Cisco explains in more detail:

“An attacker could exploit this vulnerability by sending a crafted XML packet to a vulnerable interface on an affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, cause a reload of the affected device or stop processing of incoming VPN authentication requests.”

The ACSC adds that the publicised proof of concept code results in a denial of service condition – but that code will likely evolve into code that can achieve remote code execution.

Cisco has already identified 'attempted malicious use of the vulnerability' in the wild although it is unknown whether this refers to witnessing remote code execution or a denial of service condition,” the ACSC says in an alert.

The ACSC recommends that organisations with affected devices patch as soon as possible. Cisco adds that it has released software updates to address the vulnerability, but there are currently ‘no workarounds that address all the features that are affected by this vulnerability’.

Cisco ASA software running on the following products are all vulnerable:

- 3000 Series Industrial Security Appliance (ISA)
- ASA 5500 Series Adaptive Security Appliances
- ASA 5500-X Series Next-Generation Firewalls
- ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
- ASA 1000V Cloud Firewall
- Adaptive Security Virtual Appliance (ASAv)
- Firepower 2100 Series Security Appliance
- Firepower 4110 Security Appliance
- Firepower 4120 Security Appliance
- Firepower 4140 Security Appliance
- Firepower 4150 Security Appliance
- Firepower 9300 ASA Security Module
- Firepower Threat Defense Software (FTD)
- FTD Virtual

What MSPs can learn from Datto’s Channel Ransomware Report
While there have been less high profile attacks making the headlines, the frequency of attacks is, in fact, increasing.
Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why Australian enterprises are prime targets for malware attacks
"Only 14% of Australian organisations are continuously training employees to spot cyber attacks."
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Bitdefender announces security integration with Kaseya
The new partnership will allow VSA by Kaseya’s cloud and on-premises users to deploy and manage security with Bitdefender Cloud Security for MSPs.
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.