Cisco ASA and FTD DoS Vulnerability

A vulnerability has been discovered in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software that allows a remote attacker to cause a denial-of-service (DoS) in affected devices.

Threat ID:: CC-2763
Category:: Exploit
Threat Severity:: Medium
Threat Vector:: Vulnerability
Published:: 1 November 2018 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Affected platforms

The following platforms are known to be affected:

Cisco Adaptive Security Appliance (ASA) Software

Cisco ASA software - Version 9.4 and later
Cisco FTD software - Version 6.0 and later

The following products running the specified versions of ASA and FTD software are affected:

3000 Series Industrial Security Appliance (ISA)
ASA 5500-X Series Next-Generation Firewalls
ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
Adaptive Security Virtual Appliance (ASAv)
Firepower Security Appliance - 2100 and 4100 Series
Firepower 9300 ASA Security Module
FTD Virtual (FTDv)

Cisco FirePower Threat Defense (FTD)

Cisco 3000 Series Industrial Security Appliance (ISA)

Cisco Adaptive Security Appliance (ASA) 5500-X Series Next-Generation Firewalls

Cisco Adaptive Security Appliance (ASA) Services Module for Cisco Catalyst 6500 Series

Cisco Adaptive Security Virtual Appliance (ASAv)

Cisco Adaptive Security Appliance (ASA) Services Module for Cisco Catalyst 7600

Cisco Firepower 9300 ASA Security Module

Threat details

The vulnerability is caused by mishandling of Session Initiation Protocol (SIP) traffic. An attacker can send crafted SIP requests at a high rate to cause the device to reboot or experience high CPU usage.

The SIP inspection engine is enabled by default in both the ASA and FTD software.

Remediation steps

Type	Step
	Cisco has not yet released updates to address this vulnerability. Users and administrators are encouraged to read the Cisco Security Advisory. Administrators can check if the vulnerability is being actively exploited by checking the output of show conn port 5060, which would show large volumes of incomplete SIP connections. The output of show processes cpu-usage non-zero sorted would show a high CPU utilisation. When a device crashes and reloads, the output of show crashinfo would show an unknown abort of the DATAPATH thread. The Cisco Technical Assistance Centre can determine whether the crash was related to an exploit of this vulnerability. Exploits can be mitigated by blocking traffic from the offending host. SIP inspection could also be disabled, however this will break SIP connections if they use Network Address Translation or if not all required ports are opened using Access Control Lists. In some cases, malicious traffic has had the Sent-by Address set to the invalid value 0.0.0[.]0. Filtering can be applied on the Sent-by Address to prevent crashes from this type of traffic.

Type

Step

Cisco has not yet released updates to address this vulnerability. Users and administrators are encouraged to read the Cisco Security Advisory.

Administrators can check if the vulnerability is being actively exploited by checking the output of show conn port 5060, which would show large volumes of incomplete SIP connections. The output of show processes cpu-usage non-zero sorted would show a high CPU utilisation. When a device crashes and reloads, the output of show crashinfo would show an unknown abort of the DATAPATH thread. The Cisco Technical Assistance Centre can determine whether the crash was related to an exploit of this vulnerability.

Exploits can be mitigated by blocking traffic from the offending host. SIP inspection could also be disabled, however this will break SIP connections if they use Network Address Translation or if not all required ports are opened using Access Control Lists.

In some cases, malicious traffic has had the Sent-by Address set to the invalid value 0.0.0[.]0. Filtering can be applied on the Sent-by Address to prevent crashes from this type of traffic.

Last edited: 17 February 2020 12:39 pm