Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Cisco Patches Several Vulnerabilities in ASA Software

Cisco informed customers on Wednesday that it has released software updates to address several high severity vulnerabilities affecting Cisco Adaptive Security Appliance (ASA) products.

Cisco informed customers on Wednesday that it has released software updates to address several high severity vulnerabilities affecting Cisco Adaptive Security Appliance (ASA) products.

According to the company, the Cisco ASA Software, the operating system that powers several Cisco network security solutions, is affected by command injection, memory exhaustion, and denial-of-service (DoS) flaws.

The command injection vulnerability (CVE-2015-0675), which allows an attacker to take full control of a vulnerable system, exists in the failover ipsec feature. Because secure failover communication messages are not handled properly, an unauthenticated attacker that can connect to the failover interface IP address can submit configuration commands by sending specially crafted UDP packets.

The memory exhaustion bug (CVE-2015-0676) plagues the Cisco ASA Software’s DNS code. A remote, unauthenticated attacker can cause an appliance to stop processing or forwarding traffic by exhausting available memory.

“The vulnerability is due to improper processing of DNS packets. An attacker could exploit this vulnerability by sending a request to an affected Cisco ASA appliance, which can cause it to generate a DNS request packet. The attacker would need to be able to intercept this request and reply with a crafted DNS reply packet,” Cisco wrote in its advisory.

An XML parser vulnerability (CVE-2015-0677) caused by insufficient hardening of the parser’s configuration can be exploited remotely by sending malicious XML messages to the affected system.

“Successful exploitation of the Cisco ASA VPN XML Parser Denial of Service Vulnerability may result in a crash of the WebVPN process, which may lead to the reset of all SSL VPN connections, system instability, and a reload of the affected system,” Cisco noted.

The vulnerabilities affect Cisco ASA 5500 series Adaptive Security Appliances, ASA 5500-X series Next-Generation Firewalls, the ASA Services Module for Cisco Catalyst 6500 series switches and Cisco 7600 series routers, the ASA 1000V Cloud Firewall, and the Cisco Adaptive Security Virtual Appliance (ASAv).

In a separate advisory, Cisco detailed a DoS vulnerability (CVE-2015-0678) affecting Cisco ASA FirePOWER Services, which provides protection against advanced threats, and the Cisco ASA Context Aware (CX) Service, which provides enhanced visibility and network traffic control.

The flaw can be exploited to cause an affected system to reload by sending crafted packets to the management interface at a high rate. The company has pointed out that patching this vulnerability may require updating the Cisco ASA Software.

Cisco says there is no evidence to suggest that any of these vulnerabilities have been exploited in the wild. However, users are advised to update their installations as soon as possible. The vendor has noted that workarounds are available for the Cisco ASA Software command injection and memory exhaustion vulnerabilities.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Vulnerabilities

Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.