And Yet Another Weekend Post! (YAWP)
Attackers are actively exploiting a vulnerability in the Cisco's Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software.
CVE-2018-15454 describes a vulnerability in the Session Initiation Protocol (SIP) inspection engine of ASA and FTD .
If the exploit is successful, the security breach allows a remote attacker to deploy a denial of service (DoS) condition by reloading or triggering high CPU cycles.Caused by improper handling of SIP traffic, the flaw could allow bad actors to send SIP requests designed to specifically trigger the issue at a high rate across an affected device.
In fact the vulnerability itself isn NOT too dangerous, but affected customers can nevertheless experience some downtime, with devices crashing and reloading.The vulnerability is present in Cisco ASA Software Release 9.4 and later and Cisco FTD Software Release 6.0 and later.
The following Cisco products running the software with SIP inspection enabled are confirmed as “affected:
Firepower 2100 Series Security Appliance
Firepower 4100 Series Security Appliance
Firepower 9300 ASA Security Module
3000 Series Industrial Security Appliance (ISA)
ASA 5500-X Series Next-Generation Firewalls
ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
Adaptive Security Virtual Appliance (ASAv)
FTD virtual (FTDv)
More worryingly, the vulnerability is actively being exploited in the wild.
IOC_Indicators of Compromise
Access your #Cisco_Firewall first, if the output of show conn port 5060 shows a large number of incomplete SIP connections
the output of show processes cpu-usage non-zero sorted shows a high CPU utilization.
Then, you are in a HUGE DISASTER !!! 😈
Successful exploitation of this vulnerability can also result in the affected device crashing and reloading. After the device boots up again, the output of show crashinfo will show an unknown abort of the DATAPATH thread.
How to fix and/or mitigate this issue ?!
In Cisco ASA:
no inspect sip
In Cisco FTD:
configure inspection sip disable
After applying the ACL, make sure to clear existing connections for that source using the clear conn address <ip_address> command in EXEC mode.Alternatively, the offending host can be shunned using the shun <ip_address> command in EXEC mode
regex VIAHEADER "0.0.0.0"
policy-map type inspect sip P1
match message-path regex VIAHEADER
no inspect sip
inspect sip P1
Rate limitimg using (MPF)
Some of our CybeJumper users asked us to introduce a workaround for accessing ASDM in Win10.
They tried to connect to ASDM and got the following error:
How can you fix this?!
So simple! Easy peasy !