sb-as logo
Story image

Cisco ASA appliances at risk of denial of service exploit

13 Feb 2018

The Australian Cyber Security Centre (ACSC) has issued an official alert to those who use Cisco’s Adaptive Security Appliance (ASA), after a proof of concept showed that the devices are vulnerable to a denial of service attack.

The original vulnerability (CVE-2018-0101) was found at the end of January, however by February 7 Cisco had uncovered more potential attack vectors.

According to Cisco, a vulnerability in its ASA software could allow an unauthenticated and remote attacker to cause a system reload or to remotely execute code.

The ASA could also potentially stop processing VPN authentication requests due to low memory.

“To be vulnerable the ASA must have Secure Socket Layer (SSL) services or IKEv2 Remote Access VPN services enabled on an interface. The risk of the vulnerability being exploited also depends on the accessibility of the interface to the attacker,” Cisco says.

The cause is due to a memory allocation and freeing issue during malicious XML payload processing.

Cisco explains in more detail:

“An attacker could exploit this vulnerability by sending a crafted XML packet to a vulnerable interface on an affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, cause a reload of the affected device or stop processing of incoming VPN authentication requests.”

The ACSC adds that the publicised proof of concept code results in a denial of service condition – but that code will likely evolve into code that can achieve remote code execution.

Cisco has already identified 'attempted malicious use of the vulnerability' in the wild although it is unknown whether this refers to witnessing remote code execution or a denial of service condition,” the ACSC says in an alert.

The ACSC recommends that organisations with affected devices patch as soon as possible. Cisco adds that it has released software updates to address the vulnerability, but there are currently ‘no workarounds that address all the features that are affected by this vulnerability’.

Cisco ASA software running on the following products are all vulnerable:

- 3000 Series Industrial Security Appliance (ISA) - ASA 5500 Series Adaptive Security Appliances - ASA 5500-X Series Next-Generation Firewalls - ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers - ASA 1000V Cloud Firewall - Adaptive Security Virtual Appliance (ASAv) - Firepower 2100 Series Security Appliance - Firepower 4110 Security Appliance - Firepower 4120 Security Appliance - Firepower 4140 Security Appliance - Firepower 4150 Security Appliance - Firepower 9300 ASA Security Module - Firepower Threat Defense Software (FTD) - FTD Virtual

Story image
Experiencing ransomware significantly impacts cybersecurity approach
"The survey findings illustrate clearly the impact of these near-impossible demands. Among other things, those hit by ransomware were found to have severely undermined confidence in their own cyber threat awareness."More
Story image
Lumen upgrades DDoS mitigation service as attack volumes climb
In April and May 2020, the company observed 929,000 attacks - the highest number of attacks ever seen in a 31-day period.More
Story image
Nokia: Cyber attacks on internet-connected devices on the rise
Cyberattacks on internet-connected devices continue to rise at an alarming rate due to poor security protections.More
Story image
Why zero trust could fail due to lack of understanding​, not technology
Security architects are being forced to re-examine the concept of identity, with many turning to a zero trust security model to provide a better architecture for protecting their sensitive resources.More
Story image
Insider threat report reveals deception in the workforce
Insider threats come from people inside an enterprise, whether they divulge proprietary information with nefarious intentions, or are just careless employees that unwittingly share sensitive data, writes Bitglass product marketing manager Juan Lugo.More
Story image
How to address cyber-threats as a strategic risk
Becoming a cyber-secure organisation in the face of an evolving threat landscape requires a strategic, business-focused approach to security as opposed to a tactical approach in which security is addressed simply by implementing new tools.More