Cisco informed customers on Wednesday that it has released software updates to address several high severity vulnerabilities affecting Cisco Adaptive Security Appliance (ASA) products.
According to the company, the Cisco ASA Software, the operating system that powers several Cisco network security solutions, is affected by command injection, memory exhaustion, and denial-of-service (DoS) flaws.
The command injection vulnerability (CVE-2015-0675), which allows an attacker to take full control of a vulnerable system, exists in the failover ipsec feature. Because secure failover communication messages are not handled properly, an unauthenticated attacker that can connect to the failover interface IP address can submit configuration commands by sending specially crafted UDP packets.
The memory exhaustion bug (CVE-2015-0676) plagues the Cisco ASA Software’s DNS code. A remote, unauthenticated attacker can cause an appliance to stop processing or forwarding traffic by exhausting available memory.
“The vulnerability is due to improper processing of DNS packets. An attacker could exploit this vulnerability by sending a request to an affected Cisco ASA appliance, which can cause it to generate a DNS request packet. The attacker would need to be able to intercept this request and reply with a crafted DNS reply packet,” Cisco wrote in its advisory.
An XML parser vulnerability (CVE-2015-0677) caused by insufficient hardening of the parser’s configuration can be exploited remotely by sending malicious XML messages to the affected system.
“Successful exploitation of the Cisco ASA VPN XML Parser Denial of Service Vulnerability may result in a crash of the WebVPN process, which may lead to the reset of all SSL VPN connections, system instability, and a reload of the affected system,” Cisco noted.
The vulnerabilities affect Cisco ASA 5500 series Adaptive Security Appliances, ASA 5500-X series Next-Generation Firewalls, the ASA Services Module for Cisco Catalyst 6500 series switches and Cisco 7600 series routers, the ASA 1000V Cloud Firewall, and the Cisco Adaptive Security Virtual Appliance (ASAv).
In a separate advisory, Cisco detailed a DoS vulnerability (CVE-2015-0678) affecting Cisco ASA FirePOWER Services, which provides protection against advanced threats, and the Cisco ASA Context Aware (CX) Service, which provides enhanced visibility and network traffic control.
The flaw can be exploited to cause an affected system to reload by sending crafted packets to the management interface at a high rate. The company has pointed out that patching this vulnerability may require updating the Cisco ASA Software.
Cisco says there is no evidence to suggest that any of these vulnerabilities have been exploited in the wild. However, users are advised to update their installations as soon as possible. The vendor has noted that workarounds are available for the Cisco ASA Software command injection and memory exhaustion vulnerabilities.
