Vulnslist

find the latest Cisco vulnerabilities

Multiple Vulnerabilities in Cisco ASA Software

cisco-sa-20131009-asa · Critical · Published · Updated

Cisco Adaptive Security Appliance (ASA) Software is affected by the following vulnerabilities: IPsec VPN Crafted ICMP Packet Denial of Service Vulnerability SQL*Net Inspection Engine Denial of Service Vulnerability Digital Certificate Authentication Bypass Vulnerability Remote Access VPN Authentication Bypass Vulnerability Digital Certificate HTTP Authentication Bypass Vulnerability HTTP Deep Packet Inspection Denial of Service Vulnerability DNS Inspection Denial of Service Vulnerability AnyConnect SSL VPN Memory Exhaustion Denial of Service Vulnerability SSL VPN Web Portal Denial of Service Vulnerability Crafted ICMP Packet Denial of Service Vulnerability These vulnerabilities are independent of one another; a release that is affected by one of the vulnerabilities may not be affected by the others. Successful exploitation of the IPsec VPN Crafted ICMP Packet Denial of Service Vulnerability, SQL*Net Inspection Engine Denial of Service Vulnerability, HTTP Deep Packet Inspection Denial of Service Vulnerability, DNS Inspection Denial of Service Vulnerability, and SSL VPN Web Portal Denial of Service Vulnerability may result in a reload of an affected device, leading to a denial of service (DoS) condition. Successful exploitation of the Digital Certificate Authentication Bypass Vulnerability, Remote Access VPN Authentication Bypass Vulnerability, and Digital Certificate HTTP Authentication Bypass Vulnerability may result in an authentication bypass, which could allow the attacker access to the inside network via remote access VPN or management access to the affected system via the Cisco Adaptive Security Device Management (ASDM). Successful exploitation of the AnyConnect SSL VPN Memory Exhaustion Denial of Service Vulnerability may exhaust available memory, which could result in general system instability and cause the affected system to become unresponsive and stop forwarding traffic. Successful exploitation of the Crafted ICMP Packet Denial of Service Vulnerability may cause valid connections that are passing through the affected system to be dropped, or cause a reload of the system, leading to a denial of service (DoS) condition. Cisco has released software updates that address these vulnerabilities. Workarounds are available for some of the vulnerabilities. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa Note: The Cisco Firewall Services Module (FWSM) for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers may be affected by the SQL*Net Inspection Engine Denial of Service Vulnerability. A separate Cisco Security Advisory has been published to disclose the vulnerabilities that affect the Cisco FWSM. This advisory is available at: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-fwsm

Cisco advisory ·CSAF JSON

Workarounds

IPsec VPN Crafted ICMP Packet Denial of Service Vulnerability

For VPN setup involving LAN-to-LAN tunnel, it is possible to avoid the decryption of an offending ICMP packet by implementing a vpn-filer access-list. The following commands will implement an access-list that blocks any ICMP packets flowing through a VPN tunnel that use the DfltGrpPolicy group-policy in both inbound and outbound direction:

ciscoasa(config)# access-list DENY_ICMP_ACL deny icmp any any
ciscoasa(config)# access-list DENY_ICMP_ACL permit ip any any ciscoasa(config)# group-policy DfltGrpPolicy attributes ciscoasa(config-group-policy)# vpn-filter value DENY_ICMP_ACL
Note: Because the vulnerability is triggered during the decryption operation, this workaround should be implemented on both devices terminating the VPN tunnel. This workaround is ineffective if applied to only on one side of the tunnel.

For Cisco remote IPsec VPN there is no workaround that mitigates this vulnerability.

SQL*Net Inspection Engine Denial of Service Vulnerability

Disabling Cisco ASA SQL*Net inspection will mitigate this vulnerability. The following commands will disable the SQL*Net inspection that is configured by default:

ciscoasa(config)# policy-map global_policy
ciscoasa(config-pmap)# class inspection_default ciscoasa(config-pmap-c)# no inspect sqlnet
Digital Certificate Authentication Bypass Vulnerability

There is no workaround that mitigate this vulnerability other than changing the authentication schema for the affected features.

Remote Access VPN Authentication Bypass Vulnerability

There are no workarounds other than disabling the override-account-disable option.

Digital Certificate HTTP Authentication Bypass Vulnerability

There is no workaround that mitigate this vulnerability other than changing the authentication schema for the affected features.

HTTP Deep Packet Inspection Denial of Service Vulnerability

There are no workarounds other than removing the affected option from the HTTP DPI configuration

DNS Inspection Denial of Service Vulnerability

Administrators can workaround this issue by ensuring that only UDP traffic is sent to the DNS ALPI engine for inspection.

To do that, first create an access-list to match only UDP traffic and then create a class-map to match on that access-list. Note that by default the Cisco ASA Software will only inspect DNS over UDP traffic. The following example shows Cisco ASA Software forwarding only UDP port 53 traffic to the DNS ALPI engine.

ciscoasa# show running-config access-list
access-list DNS_INSPECT extended permit udp any any eq 53 ciscoasa# show running-config class-map ! class-map DNS_INSPECT_CP match access-list DNS_INSPECT [...] ciscoasa# show running-config policy-map ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect ftp inspect h323 h225 [...] class DNS_INSPECT_CP inspect dns preset_dns_map !
Note: Inspection of DNS traffic over TCP is currently not supported by the Cisco ASA Software. Implementing this workaround does not create any loss in functionality.

AnyConnect SSL VPN Memory Exhaustion Denial of Service Vulnerability

There is no workaround other than disabling AnyConnect SSL VPN feature.

SSL VPN Web Portal Denial of Service Vulnerability

There is no workaround other than disabling the SSL VPN feature.

Crafted ICMP Packet Denial of Service Vulnerability

Administrators can disable the default ICMP policy and ICMP inspection engine to work around this vulnerability.
To disable the default ICMP policy use the icmp deny any command for all the configured interfaces of the Cisco ASA Software. To disable the default ICMP policy for ICMPv6 use the ipv6 icmp deny any command for all the IPv6 enabled interfaces of the Cisco ASA Software. The following example shows how to disable the default ICMP policy and default ICMP policy for ICMPv6 on the outside interface
ciscoasa(config)# icmp deny any outside
ciscoasa(config)# ipv6 icmp deny any outside
Note: Disabling the ICMP processing on the firewall interface may result in administrators not being able to receive any more information from the firewall via ICMP, which includes ping, traceroute, etc. Disabling the ICMPv6 processing on the firewall interface may result in the firewall not being able to communicate on that interface due to a missing neighbor discovery and neighbor advertisement ICMPv6 packets.

To disable the ICMP inspection engine, use the no inspect icmp command within the policy-map applied to the service polices.
The following example shows how to disable the ICMP inspection engine in the policy-map called global_policy:
ciscoasa(config)# policy-map global_policy
ciscoasa(config-pmap)# class inspection_default
ciscoasa(config-pmap-c)# no inspect icmp

CVEsCVE-2013-3415, CVE-2013-5507, CVE-2013-5508, CVE-2013-5509, CVE-2013-5510, CVE-2013-5511, CVE-2013-5512, CVE-2013-5513, CVE-2013-5515, CVE-2013-5542
Cisco Bug IDsCSCtt36737, CSCua22709, CSCub98434, CSCud37992, CSCue18975, CSCuf52468, CSCug03975, CSCug83401, CSCuh44815, CSCui34914, CSCui77398
CVSS ScoreBase 7.1
Base 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C
Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C
Base 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N/E:F/RL:OF/RC:C
Base 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C
Base 8.5 AV:N/AC:L/Au:N/C:N/I:P/A:C/E:F/RL:OF/RC:C
Product Names From Source
Cisco Firewall Services Module (FWSM), Cisco Adaptive Security Appliance (ASA) Software 7.0.1, Cisco Adaptive Security Appliance (ASA) Software 7.0.1.4, Cisco Adaptive Security Appliance (ASA) Software 7.0.4, Cisco Adaptive Security Appliance (ASA) Software 7.0.4.2, Cisco Adaptive Security Appliance (ASA) Software 7.0.2, Cisco Adaptive Security Appliance (ASA) Software 7.0.3, Cisco Adaptive Security Appliance (ASA) Software 7.0.7.1, Cisco Adaptive Security Appliance (ASA) Software 7.0.8, Cisco Adaptive Security Appliance (ASA) Software 7.0.7, Cisco Adaptive Security Appliance (ASA) Software 7.0.6, Cisco Adaptive Security Appliance (ASA) Software 7.0.5, Cisco Adaptive Security Appliance (ASA) Software 7.0.5.12, Cisco Adaptive Security Appliance (ASA) Software 7.0.6.4, Cisco Adaptive Security Appliance (ASA) Software 7.0.6.8, Cisco Adaptive Security Appliance (ASA) Software 7.0.6.18, Cisco Adaptive Security Appliance (ASA) Software 7.0.6.22, Cisco Adaptive Security Appliance (ASA) Software 7.0.6.26, Cisco Adaptive Security Appliance (ASA) Software 7.0.6.29, Cisco Adaptive Security Appliance (ASA) Software 7.0.6.32, Cisco Adaptive Security Appliance (ASA) Software 7.0.7.4, Cisco Adaptive Security Appliance (ASA) Software 7.0.7.9, Cisco Adaptive Security Appliance (ASA) Software 7.0.7.12, Cisco Adaptive Security Appliance (ASA) Software 7.0.8.2, Cisco Adaptive Security Appliance (ASA) Software 7.0.8.8, Cisco Adaptive Security Appliance (ASA) Software 7.0.8.12, Cisco Adaptive Security Appliance (ASA) Software 7.0.8.13, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.61, Cisco Adaptive Security Appliance (ASA) Software 7.1.2, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.81, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.64, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.72, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.16, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.20, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.24, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.28, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.38, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.42, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.46, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.49, Cisco Adaptive Security Appliance (ASA) Software 7.1.2.53, Cisco Adaptive Security Appliance (ASA) Software 7.2.2.34, Cisco Adaptive Security Appliance (ASA) Software 7.2.3.1, Cisco Adaptive Security Appliance (ASA) Software 7.2.2, Cisco Adaptive Security Appliance (ASA) Software 7.2.4, Cisco Adaptive Security Appliance (ASA) Software 7.2.3, Cisco Adaptive Security Appliance (ASA) Software 7.2.1, Cisco Adaptive Security Appliance (ASA) Software 7.2.4.27, Cisco Adaptive Security Appliance (ASA) Software 7.2.4.30, Cisco Adaptive Security Appliance (ASA) Software 7.2.5, Cisco Adaptive Security Appliance (ASA) Software 7.2.4.33, Cisco Adaptive Security Appliance (ASA) Software 7.2.1.9, Cisco Adaptive Security Appliance (ASA) Software 7.2.1.13, Cisco Adaptive Security Appliance (ASA) Software 7.2.1.19, Cisco Adaptive Security Appliance (ASA) Software 7.2.1.24, Cisco Adaptive Security Appliance (ASA) Software 7.2.2.6, Cisco Adaptive Security Appliance (ASA) Software 7.2.2.10, Cisco Adaptive Security Appliance (ASA) Software 7.2.2.14, Cisco Adaptive Security Appliance (ASA) Software 7.2.2.18, Cisco Adaptive Security Appliance (ASA) Software 7.2.2.19, Cisco Adaptive Security Appliance (ASA) Software 7.2.2.22, Cisco Adaptive Security Appliance (ASA) Software 7.2.3.12, Cisco Adaptive Security Appliance (ASA) Software 7.2.3.16, Cisco Adaptive Security Appliance (ASA) Software 7.2.4.6, Cisco Adaptive Security Appliance (ASA) Software 7.2.4.9, Cisco Adaptive Security Appliance (ASA) Software 7.2.4.18, Cisco Adaptive Security Appliance (ASA) Software 7.2.4.25, Cisco Adaptive Security Appliance (ASA) Software 7.2.5.2, Cisco Adaptive Security Appliance (ASA) Software 7.2.5.4, Cisco Adaptive Security Appliance (ASA) Software 7.2.5.7, Cisco Adaptive Security Appliance (ASA) Software 7.2.5.8, Cisco Adaptive Security Appliance (ASA) Software 7.2.5.10, Cisco Adaptive Security Appliance (ASA) Software 8.0.2.11, Cisco Adaptive Security Appliance (ASA) Software 8.0.4, Cisco Adaptive Security Appliance (ASA) Software 8.0.3, Cisco Adaptive Security Appliance (ASA) Software 8.0.2, Cisco Adaptive Security Appliance (ASA) Software 8.0.1.2, Cisco Adaptive Security Appliance (ASA) Software 8.0.4.25, Cisco Adaptive Security Appliance (ASA) Software 8.0.4.28, Cisco Adaptive Security Appliance (ASA) Software 8.0.4.33, Cisco Adaptive Security Appliance (ASA) Software 8.0.4.32, Cisco Adaptive Security Appliance (ASA) Software 8.0.5, Cisco Adaptive Security Appliance (ASA) Software 8.0.2.15, Cisco Adaptive Security Appliance (ASA) Software 8.0.3.6, Cisco Adaptive Security Appliance (ASA) Software 8.0.3.12, Cisco Adaptive Security Appliance (ASA) Software 8.0.3.19, Cisco Adaptive Security Appliance (ASA) Software 8.0.4.3, Cisco Adaptive Security Appliance (ASA) Software 8.0.4.9, Cisco Adaptive Security Appliance (ASA) Software 8.0.4.16, Cisco Adaptive Security Appliance (ASA) Software 8.0.4.23, Cisco Adaptive Security Appliance (ASA) Software 8.0.4.31, Cisco Adaptive Security Appliance (ASA) Software 8.0.5.20, Cisco Adaptive Security Appliance (ASA) Software 8.0.5.23, Cisco Adaptive Security Appliance (ASA) Software 8.0.5.25, Cisco Adaptive Security Appliance (ASA) Software 8.0.5.27, Cisco Adaptive Security Appliance (ASA) Software 8.0.5.28, Cisco Adaptive Security Appliance (ASA) Software 8.0.5.31, Cisco Adaptive Security Appliance (ASA) Software 8.2.0.45, Cisco Adaptive Security Appliance (ASA) Software 8.2.1, Cisco Adaptive Security Appliance (ASA) Software 8.2.2, Cisco Adaptive Security Appliance (ASA) Software 8.2.2.10, Cisco Adaptive Security Appliance (ASA) Software 8.2.3, Cisco Adaptive Security Appliance (ASA) Software 8.2.4, Cisco Adaptive Security Appliance (ASA) Software 8.2.1.11, Cisco Adaptive Security Appliance (ASA) Software 8.2.2.9, Cisco Adaptive Security Appliance (ASA) Software 8.2.2.12, Cisco Adaptive Security Appliance (ASA) Software 8.2.2.16, Cisco Adaptive Security Appliance (ASA) Software 8.2.4.1, Cisco Adaptive Security Appliance (ASA) Software 8.2.4.4, Cisco Adaptive Security Appliance (ASA) Software 8.2.5, Cisco Adaptive Security Appliance (ASA) Software 8.2.5.13, Cisco Adaptive Security Appliance (ASA) Software 8.2.5.22, Cisco Adaptive Security Appliance (ASA) Software 8.2.5.26, Cisco Adaptive Security Appliance (ASA) Software 8.2.2.17, Cisco Adaptive Security Appliance (ASA) Software 8.2.5.33, Cisco Adaptive Security Appliance (ASA) Software 8.2.5.40, Cisco Adaptive Security Appliance (ASA) Software 8.2.5.41, Cisco Adaptive Security Appliance (ASA) Software 8.1.1, Cisco Adaptive Security Appliance (ASA) Software 8.1.2, Cisco Adaptive Security Appliance (ASA) Software 8.1.2.15, Cisco Adaptive Security Appliance (ASA) Software 8.1.2.16, Cisco Adaptive Security Appliance (ASA) Software 8.1.2.19, Cisco Adaptive Security Appliance (ASA) Software 8.1.2.23, Cisco Adaptive Security Appliance (ASA) Software 8.1.2.24, Cisco Adaptive Security Appliance (ASA) Software 8.1.2.50, Cisco Adaptive Security Appliance (ASA) Software 8.1.1.6, Cisco Adaptive Security Appliance (ASA) Software 8.1.2.13, Cisco Adaptive Security Appliance (ASA) Software 8.1.2.49, Cisco Adaptive Security Appliance (ASA) Software 8.1.2.55, Cisco Adaptive Security Appliance (ASA) Software 8.1.2.56, Cisco Adaptive Security Appliance (ASA) Software 8.3.1.1, Cisco Adaptive Security Appliance (ASA) Software 8.3.1, Cisco Adaptive Security Appliance (ASA) Software 8.3.2, Cisco Adaptive Security Appliance (ASA) Software 8.3.2.23, Cisco Adaptive Security Appliance (ASA) Software 8.3.2.25, Cisco Adaptive Security Appliance (ASA) Software 8.3.1.4, Cisco Adaptive Security Appliance (ASA) Software 8.3.1.6, Cisco Adaptive Security Appliance (ASA) Software 8.3.2.4, Cisco Adaptive Security Appliance (ASA) Software 8.3.2.13, Cisco Adaptive Security Appliance (ASA) Software 8.3.2.31, Cisco Adaptive Security Appliance (ASA) Software 8.3.2.33, Cisco Adaptive Security Appliance (ASA) Software 8.3.2.34, Cisco Adaptive Security Appliance (ASA) Software 8.3.2.37, Cisco Adaptive Security Appliance (ASA) Software 8.4.1, Cisco Adaptive Security Appliance (ASA) Software 8.4.2, Cisco Adaptive Security Appliance (ASA) Software 8.4.1.3, Cisco Adaptive Security Appliance (ASA) Software 8.4.1.11, Cisco Adaptive Security Appliance (ASA) Software 8.4.2.8, Cisco Adaptive Security Appliance (ASA) Software 8.4.3, Cisco Adaptive Security Appliance (ASA) Software 8.4.3.8, Cisco Adaptive Security Appliance (ASA) Software 8.4.3.9, Cisco Adaptive Security Appliance (ASA) Software 8.4.4, Cisco Adaptive Security Appliance (ASA) Software 8.4.4.1, Cisco Adaptive Security Appliance (ASA) Software 8.4.4.3, Cisco Adaptive Security Appliance (ASA) Software 8.4.4.5, Cisco Adaptive Security Appliance (ASA) Software 8.4.4.9, Cisco Adaptive Security Appliance (ASA) Software 8.4.5, Cisco Adaptive Security Appliance (ASA) Software 8.4.5.6, Cisco Adaptive Security Appliance (ASA) Software 8.4.6, Cisco Adaptive Security Appliance (ASA) Software 8.4.2.1, Cisco Adaptive Security Appliance (ASA) Software 8.4.7, Cisco Adaptive Security Appliance (ASA) Software 8.5.1, Cisco Adaptive Security Appliance (ASA) Software 8.5.1.1, Cisco Adaptive Security Appliance (ASA) Software 8.5.1.6, Cisco Adaptive Security Appliance (ASA) Software 8.5.1.7, Cisco Adaptive Security Appliance (ASA) Software 8.5.1.14, Cisco Adaptive Security Appliance (ASA) Software 8.5.1.17, Cisco Adaptive Security Appliance (ASA) Software 8.6.1.1, Cisco Adaptive Security Appliance (ASA) Software 8.6.1, Cisco Adaptive Security Appliance (ASA) Software 8.6.1.2, Cisco Adaptive Security Appliance (ASA) Software 8.6.1.5, Cisco Adaptive Security Appliance (ASA) Software 8.6.1.10, Cisco Adaptive Security Appliance (ASA) Software 8.7.1, Cisco Adaptive Security Appliance (ASA) Software 8.7.1.1, Cisco Adaptive Security Appliance (ASA) Software 8.7.1.3, Cisco Adaptive Security Appliance (ASA) Software 8.7.1.4, Cisco Adaptive Security Appliance (ASA) Software 8.7.1.7, Cisco Adaptive Security Appliance (ASA) Software 9.0.1, Cisco Adaptive Security Appliance (ASA) Software 9.0.2, Cisco Adaptive Security Appliance (ASA) Software 9.0.2.10, Cisco Adaptive Security Appliance (ASA) Software 9.0.3, Cisco Adaptive Security Appliance (ASA) Software 9.0.3.6, Cisco Adaptive Security Appliance (ASA) Software 9.1.1, Cisco Adaptive Security Appliance (ASA) Software 9.1.1.4, Cisco Adaptive Security Appliance (ASA) Software 9.1.2, Cisco Adaptive Security Appliance (ASA) Software 9.1.3, Cisco Adaptive Security Appliance (ASA) Software 9.1.2.8, Cisco Adaptive Security Appliance (ASA) Software

Related Products

Product CVE Evidence
Cisco Firewall Services Module (FWSM) CVE-2013-5542 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2013-5515 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2013-5513 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2013-5512 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2013-5511 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2013-5510 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2013-5509 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2013-5508 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2013-5507 Cisco OpenVuln
Cisco Firewall Services Module (FWSM) CVE-2013-3415 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2013-5542 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2013-5515 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2013-5513 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2013-5512 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2013-5511 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2013-5510 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2013-5509 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2013-5508 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2013-5507 Cisco OpenVuln
Cisco Adaptive Security Appliance (ASA) Software CVE-2013-3415 Cisco OpenVuln