DOS vulnerability on Cisco Firewalls (ASA, FTD)

 

 

And Yet Another Weekend Post! (YAWP)


Attackers are actively exploiting a vulnerability in the Cisco's Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software.


CVE-2018-15454 describes a vulnerability in the Session Initiation Protocol (SIP) inspection engine of ASA and FTD .
If the exploit is successful, the security breach allows a remote attacker to deploy a denial of service (DoS) condition by reloading or triggering high CPU cycles.Caused by improper handling of SIP traffic, the flaw could allow bad actors to send SIP requests designed to specifically trigger the issue at a high rate across an affected device.


In fact the vulnerability itself isn NOT too dangerous, but affected customers can nevertheless experience some downtime, with devices crashing and reloading.The vulnerability is present in Cisco ASA Software Release 9.4 and later and Cisco FTD Software Release 6.0 and later.

 

The following Cisco products running the software with SIP inspection enabled are confirmed as “affected:

 

  • Firepower 2100 Series Security Appliance

  • Firepower 4100 Series Security Appliance

  • Firepower 9300 ASA Security Module

  • 3000 Series Industrial Security Appliance (ISA)

  • ASA 5500-X Series Next-Generation Firewalls

  • ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers

  • Adaptive Security Virtual Appliance (ASAv)

  • FTD virtual (FTDv)

More worryingly, the vulnerability is actively being exploited in the wild.

 

 

IOC_Indicators of Compromise

 

 

Access your #Cisco_Firewall first, if the output of show conn port 5060 shows a large number of incomplete SIP connections

and

the output of show processes cpu-usage non-zero sorted shows a high CPU utilization.
Then, you are in a HUGE DISASTER !!! 😈

 

Successful exploitation of this vulnerability can also result in the affected device crashing and reloading. After the device boots up again, the output of show crashinfo will show an unknown abort of the DATAPATH thread.
 

 

 

 

How to fix and/or mitigate this issue ?!

 

  • Option 1: Disable SIP Inspection

 

In Cisco ASA:

 

 policy-map global_policy

  class inspection_default

     no inspect sip

 

In Cisco FTD:

 

configure inspection sip disable

 

 

 

 

  • Option 2: Block the Offending Host(s)

 

After applying the ACL, make sure to clear existing connections for that source using the clear conn address <ip_address> command in EXEC mode.Alternatively, the offending host can be shunned using the shun <ip_address> command in EXEC mode

 

  • Option 3: Filter on Sent-by Address of 0.0.0.0

 

regex VIAHEADER "0.0.0.0"

policy-map type inspect sip P1

parameters

match message-path regex VIAHEADER

drop

 

policy-map global_policy

class inspection_default

no inspect sip

inspect sip P1

 

 

  • Option 4: Rate Limit SIP Traffic

 

Rate limitimg using (MPF)
 

 

 

Some of our CybeJumper users asked us to introduce a workaround for accessing ASDM in Win10.
They tried to connect to ASDM and  got the following error:

 

 

 

How can you fix this?! 


So simple! Easy peasy !