Tag Archive for: Cisco

Vulnerability: CVE-2018-0228 – Cisco ASA DOS Vulnerability

/by

A vulnerability has been discovered in the ingress flow creation functionality of the Cisco Adaptive Security Appliance (ASA).  This vulnerability could potentially allow an unauthenticated, remote attacker to send a steady stream of malicious IP packets to DoS (denial of service) and infect the system by maxing out CPU usage. A DoS of this type could cripple network traffic that is being routed through the device, and would directly impact the availability of business resources. Cisco has not publicly released details regarding what traffic to send to initiate the DoS.

This vulnerability affects Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software that is running on the following Cisco products:

  • 3000 Series Industrial Security Appliances (ISA)
  • ASA 5500 Series Adaptive Security Appliances
  • ASA 5500-X Series Next-Generation Firewalls
  • ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
  • Adaptive Security Virtual Appliances (ASAv)
  • Firepower 2100 Series Security Appliances
  • Firepower 4110 Security Appliances
  • Firepower 9300 ASA Security Modules.

Proficio Threat Intelligence Recommendations:

  • Workaround: The ASA and FTD configuration commands, set connection per-client-embryonic-max (TCP) and set connection per-client-max (TCP, UDP, and Stream Control Transmission Protocol {SCTP}), can be configured to limit the number of connection requests allowed.  Setting the vendor recommended configuration parameters can reduce the number of connections and greatly reduce the impact of the DoS attack
  • Permanent Fix: Customers should upgrade to an appropriate firmware release as indicated in the link below

Firmware Checker –  Click Here

Vulnerability: CVE-2018-0171 – Cisco IOS and IOS XE Software Smart Install – Remote Code Execution

/by

Cisco has disclosed a vulnerability in the Smart Install feature of the Cisco IOS Software and Cisco IOS XE Software.  This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on affected switches as well as leverage this vulnerability to cause the devices to reload, which will result in a temporary DoS while the devices are reloading.

The vulnerability is due to improper validation of packet data resulting in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected switch on TCP port 4786. Only Smart Install client switches are affected by the vulnerability. Smart Install client functionality is enabled by default on Cisco IOS switches on software releases that have not been updated to address the Cisco bug ID CSCvd36820.

Researchers said they had identified roughly 250,000 vulnerable Cisco devices with TCP port 4786 open. Sophisticated nation-state groups have previously exploited vulnerabilities in Smart Install in their campaigns targeting critical infrastructure. There has not been any evidence indicating that CVE-2018-0171 has been exploited in malicious attacks.

Cisco has responded by releasing software updates to fix this critical vulnerability for affected switches. Switches that are running releases earlier than Cisco IOS Software Release 12.2(52)SE are not capable of running Smart Install.

Proficio Threat Intelligence Recommendations:

  • Utilize the Cisco IOS Software Checker to determine if devices are vulnerable

Cisco IOS Software Checker – Click Here
General Information – Click Here