Cisco ASA and Firepower Being Exploited in the Wild – Apply Mitigations ASAP

save
Share and earn Cybytes
Facebook Twitter Google+ LinkedIn Email

Cisco advised that the Adaptive Security Appliance (ASA) and Firepower systems are being exploited in the wild with a Session Initiation Protocol (SIP) vulnerability. There is currently no patch.

Background

Cisco posted an advisory today warning users that their popular Adaptive Security Appliance (ASA) and Firepower Threat Defense Software are vulnerable to a Session Initiation Protocol (SIP) handling bug currently being exploited in the wild. As of November 1 10:00 a.m. (EST), there is no patch or workaround available. In the meantime, Cisco has provided mitigation guidance.

Impact assessment

According to Cisco: “While the vulnerability described in this advisory is being actively exploited, the output of show conn port 5060 will show a large number of incomplete SIP connections and the output of show processes cpu-usage non-zero sorted will show a high CPU utilization. Successful exploitation of this vulnerability can also result in a denial of service (DOS) causing the affected device to crash and reload. After the device boots up again, the output of show crashinfo will show an unknown abort of the DATAPATH thread.”

Vulnerability details

The vulnerability is reportedly caused by improper SIP inspection. SIP is a common protocol used for voice over IP (VoIP). It is also used for file transfer, instant messaging, video conferencing and streaming media. SIP can be run over TCP, UDP or other networking protocols.The following Cisco devices are listed as affected:

  • 3000 Series Industrial Security Appliance (ISA)
  • ASA 5500-X Series Next-Generation Firewalls
  • ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
  • Adaptive Security Virtual Appliance (ASAv)
  • Firepower 2100 Series Security Appliance
  • Firepower 4100 Series Security Appliance
  • Firepower 9300 ASA Security Module
  • FTD Virtual (FTDv)

The vulnerability reportedly does not impact the following devices:

  • ASA 1000V Cloud Firewall
  • ASA 5500 Series Adaptive Security Appliances

Urgently required actions

Due to the fact this issue is reportedly being exploited in the wild and the “default on” nature of SIP inspection, users are urged to apply the mitigations provided by Cisco ASAP. Several mitigating controls are provided:

  • Disabling SIP inspection (on by default): Disabling SIP inspection will completely close the attack vector for this vulnerability. However, it may not be suitable for everyone. In particular, disabling SIP inspection would break SIP connections if either Network Address Translation (NAT) is applied to SIP traffic or if not all ports required for SIP communication are opened via ACL. To disable SIP inspection, configure the following:

Cisco ASA Software and Cisco FTD Software Releases 6.2 and later (in FTD 6.2 and later use Cisco FMC to add the following via FlexConfig policy):

<code>

policy-map global_policy

class inspection_default

no inspect sip

Cisco FTD Software Releases prior to 6.2:

configure inspection sip disable

</code>

Additionally, the mitigations below are described in the advisory:

  • Blocking the attacking host
  • Filtering on Sent-by Address of 0.0.0.0, as that address has reportedly been used by attackers in ongoing exploitation

Identifying affected systems

Tenable is actively monitoring for any updates provided by Cisco and will provide plugin coverage as soon as it becomes available.

Get more information

Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

Share this post and earn Cybytes
Facebook Twitter Google+ LinkedIn Email
Follow
1592 Followers
About Tenable
Tenable™, Inc. is the Cyber Exposure company. Over 24,000 organizations of all sizes around the globe rely on Tenable to manage and measure their modern attack surface to accurately understand and reduce cyber risk. As the creator of Nessus®, Tenable built its platform from the ground up to deeply understand assets, networks and vulnerabilities, extending this knowledge and expertise into Tenable.io™ to deliver the world’s first platform to provide live visibility into any asset on any computing platform. Tenable customers include over 50 percent of the Fortune 500, large government agencies and organizations across the private and public sectors. Learn more at tenable.com.
Promoted Content
Five Steps to Building a Successful Vulnerability Management Program
Is your vulnerability management program struggling? Despite proven technology solutions and the best efforts of IT teams, unresolved vulnerabilities remain an ongoing source of friction and frustration in many organizations. Regardless of how many vulnerabilities are fixed, there will always be vulnerabilities that can’t easily be remediated – and too often, finger-pointing between IT teams and business groups can ensue.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Cybrary On The Go

Get the Cybrary app for Android for online and offline viewing of our lessons.

Get it on Google Play
 

Support Cybrary

Donate Here to Get This Month's Donor Badge

 
Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?

Continue
Cancel