DOS vulnerability on Cisco Firewalls (ASA, FTD)
And Yet Another Weekend Post! (YAWP)
Attackers are actively exploiting a vulnerability in the Cisco's Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. CVE-2018-15454 describes a vulnerability in the Session Initiation Protocol (SIP) inspection engine of ASA and FTD . If the exploit is successful, the security breach allows a remote attacker to deploy a denial of service (DoS) condition by reloading or triggering high CPU cycles.Caused by improper handling of SIP traffic, the flaw could allow bad actors to send SIP requests designed to specifically trigger the issue at a high rate across an affected device.
In fact the vulnerability itself isn NOT too dangerous, but affected customers can nevertheless experience some downtime, with devices crashing and reloading.The vulnerability is present in Cisco ASA Software Release 9.4 and later and Cisco FTD Software Release 6.0 and later.
The following Cisco products running the software with SIP inspection enabled are confirmed as “affected:
Firepower 2100 Series Security Appliance
Firepower 4100 Series Security Appliance
Firepower 9300 ASA Security Module
3000 Series Industrial Security Appliance (ISA)
ASA 5500-X Series Next-Generation Firewalls
ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
Adaptive Security Virtual Appliance (ASAv)
FTD virtual (FTDv)
More worryingly, the vulnerability is actively being exploited in the wild.
IOC_Indicators of Compromise
Access your #Cisco_Firewall first, if the output of show conn port 5060 shows a large number of incomplete SIP connections
and
the output of show processes cpu-usage non-zero sorted shows a high CPU utilization. Then, you are in a HUGE DISASTER !!! 😈
Successful exploitation of this vulnerability can also result in the affected device crashing and reloading. After the device boots up again, the output of show crashinfo will show an unknown abort of the DATAPATH thread.
How to fix and/or mitigate this issue ?!
Option 1: Disable SIP Inspection
In Cisco ASA:
policy-map global_policy
class inspection_default
no inspect sip
In Cisco FTD:
configure inspection sip disable
Option 2: Block the Offending Host(s)
After applying the ACL, make sure to clear existing connections for that source using the clear conn address <ip_address> command in EXEC mode.Alternatively, the offending host can be shunned using the shun <ip_address> command in EXEC mode
Option 3: Filter on Sent-by Address of 0.0.0.0
regex VIAHEADER "0.0.0.0"
policy-map type inspect sip P1
parameters
match message-path regex VIAHEADER
drop
policy-map global_policy
class inspection_default
no inspect sip
inspect sip P1
Option 4: Rate Limit SIP Traffic
Rate limitimg using (MPF)
Some of our CybeJumper users asked us to introduce a workaround for accessing ASDM in Win10. They tried to connect to ASDM and got the following error:
How can you fix this?!
So simple! Easy peasy !
Go the properties of the ASDM shortcut, and look at the ‘Target‘ value and change it to the following
C:\Windows\system32\wscript.exe invisible.vbs run.bat
Apply > OK.
There you go! Now you can access ASDM!
TRADEMARK LEGAL NOTICE
All product names, logos, and brands are the property of their respective owners in Austria or other countries. All company, product and service names used on this website are for identification purposes only. Pheniix is not affiliated with or an official partner of Cisco, CompTIA,Dimension Data, VMware, Amazon, Microsoft, Certified Ethical Hacker, (ISC)², Juniper, Wireshark, Offensive Security,Google, GNS3, F5, Python, Linux, Java, OpenStack, Vagrant, Ansible, Docker, GIT, , Blockchain or other companies. Use of these names, logos, and brands does not imply endorsement. The opinions expressed on pheniix are personal perspectives and not those of Cisco, Dimension Data or any other company. Pheniix runs as an independent blog.
#MikeGhahremani #Pheniix #InfoSec #ASASecurityDeviceManagerASDM #NationalCyberSecurityAwarenessMonth #Cybersecurity #Security #CloudSecurity #CiscoSecurity #securityflaw #CyberSecurity #security #ASA #IPSEC #FTD #CiscoFIREPOWER #Ciscobug #Cisco #IOC