Jump to content


0

Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability


2 replies to this topic

#1 vbsalongo

vbsalongo

    Microsoft TE

  • Members
  • PipPipPip
  • 67 posts
  • 8050 thanks

Posted 12 February 2016 - 05:28 PM

Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160210-asa-ike
                          

Critical                                
                            
Advisory ID:
cisco-sa-20160210-asa-ike


Last Updated:
2016 February 12 14:48  GMT


Published:
2016 February 10 16:00  GMT


Version 1.1:
Final


CVSS Score:

Base - 10.0


Workarounds:
No workarounds available

Cisco Bug IDs:
CSCux29978
CSCux42019

                              
CVE-2016-1287


CWE-119


Summary
  • A vulnerability in the Internet Key Exchange (IKE) version 1 (v1) and IKE version 2 (v2) code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code.

    The vulnerability is due to a buffer overflow in the affected code area. An attacker could exploit this vulnerability by sending crafted UDP packets to the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system.

    Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed firewall mode only and in single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic.

    Cisco has released software updates that address this vulnerability. This advisory is available at the following link:
    http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160210-asa-ike
Affected Products
  • Affected Cisco ASA Software running on the following products may be affected by this vulnerability:

    • Cisco ASA 5500 Series Adaptive Security Appliances

    • Cisco ASA 5500-X Series Next-Generation Firewalls

    • Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers

    • Cisco ASA 1000V Cloud Firewall

    • Cisco Adaptive Security Virtual Appliance (ASAv)

    • Cisco Firepower 9300 ASA Security Module

    • Cisco ISA 3000 Industrial Security Appliance
    Refer to the "Fixed Software" section of this security advisory for more information about the affected releases.



    Vulnerable Products

    Cisco ASA Software is affected by this vulnerability if the system is configured to terminate IKEv1 or IKEv2 VPN connections.

    This includes the following:

    • LAN-to-LAN IPsec VPN

    • Remote access VPN using the IPsec VPN client

    • Layer 2 Tunneling Protocol (L2TP)-over-IPsec VPN connections

    • IKEv2 AnyConnect
    Cisco ASA Software is not affected by this vulnerability if the system is configured to terminate only the following VPN connections:
    • Clientless SSL

    • AnyConnect SSL
    To determine whether the Cisco ASA is configured to terminate IKEv1 or IKEv2 VPN connections, a crypto map must be configured for at least one interface. Administrators should use the show running-config crypto map | include interface command and verify that it returns output. The following example shows a crypto map called outside_map configured on the outside interface:



    ciscoasa# show running-config crypto map | include interface
    crypto map outside_map interface outside


    Products Confirmed Not Vulnerable

    No other Cisco products are currently known to be affected by this vulnerability.

                                    
Indicators of Compromise                                          
  • There are no workarounds that address this vulnerability.
Fixed Software
  • Cisco has released free software updates that address the vulnerability described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:
    <a href="http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; font-size: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 127, 197); text-decoration: none; cursor: pointer; word-wrap: break-word;">http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html

    Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.

    When considering software upgrades, customers are advised to consult the Cisco Security Advisories and Responses archive athttp://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.

    In all cases, customers should ensure that the devices to upgrade contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

    Customers Without Service Contracts

    Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC):
    http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html

    Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.

    Fixed Releases

    In the following table, the left column lists major releases of Cisco ASA Software. The right column indicates whether a major release is affected by the vulnerability described in this advisory and the first release that includes the fix for this vulnerability.



    Cisco ASA Major Release                                                                                             
    First Fixed Release 7.21 Affected; migrate to 9.1(7) or later 8.21 Affected; migrate to 9.1(7) or later 8.31 Affected; migrate to 9.1(7) or later 8.4 8.4(7.30) 8.51 Not affected 8.61 Affected; migrate to 9.1(7) or later 8.7 8.7(1.18) 9.0 9.0(4.38) 9.1 9.1(7) 9.2 9.2(4.5) 9.3 9.3(3.7) 9.4 9.4(2.4) 9.5 9.5(2.2)                                 
  • 1Cisco ASA Software releases 7.2, 8.2, 8.3, 8.5, and 8.6 have reached End of Software Maintenance. Customers should migrate to a supported release.

    Software Download

    Cisco ASA Software can be downloaded from the Software Center on Cisco.com by visitinghttp://www.cisco.com/cisco/software/navigator.html.

    For Cisco ASA 5500 Series Adaptive Security Appliances and Cisco ASA 5500-X Series Next-Generation Firewall, navigate to the following path. To find interim versions, click All Releases > Interim on the left side of the download page.



    Products > Security > Firewalls > Adaptive Security Appliances (ASA) > ASA 5500-X Series Firewalls > <your Cisco ASA model> > Software on Chassis > Adaptive Security Appliance (ASA) Software

    For the Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, navigate to the following path. To find interim versions, click All Releases > Interim on the left side of the download page.


    Products > Cisco Interfaces and Modules > Services Modules > Catalyst 6500 Series / 7600 Series ASA Services Module > Adaptive Security Appliance (ASA) Software

    For the Cisco ASA 1000V Cloud Firewall, navigate to the following path:


    Products > Security > Firewalls > Adaptive Security Appliances (ASA) > ASA 1000V Cloud Firewall

    For the Cisco Adaptive Security Virtual Appliance (ASAv), navigate to the following path:


    Products > Security > Firewalls > Adaptive Security Appliances (ASA) > Adaptive Security Virtual Appliance (ASAv) > Adaptive Security Appliance (ASA) Software

    For the Cisco Firepower 9300 ASA Module, navigate to the following path:


    Products > Security > Firewalls > Next-Generation Firewalls (NGFW) > Firepower 9000 Series > Firepower 9300 Security Appliance >Adaptive Security Appliance (ASA) Software

    For the Cisco ISA 3000 Industrial Security Appliance, navigate to the following path:


    Products > Security > Firewalls > 3000 Series Industrial Security Appliances (ISA) >  <your Cisco ISA 3000 model> > Adaptive Security Appliance (ASA) Software

    Show Less
Exploitation and Public Announcements

  • The Cisco Product Security Incident Response Team (PSIRT) is not aware of any malicious use of the vulnerability that is described in this advisory.

    Exodus Intelligence has provided a public blog post which is available at the following link:
    https://blog.exodusintel.com/2016/02/10/firewall-hacking/
Source

  • This vulnerability was reported to Cisco by David Barksdale, Jordan Gruskovnjak, and Alex Wheeler of Exodus Intelligence.


URL

Edited by vbsalongo, 12 February 2016 - 05:32 PM.

MCSA/MCSE Security/MCTS/MCITP Server Administrator/CCNA/CCNP

In God I TrustS

#2 kajeji

kajeji

    Junior Member

  • Members
  • PipPip
  • 1 posts
  • 0 thanks

Posted 13 February 2016 - 10:06 AM

I'm facing the same situation,

so the solution to upgrade my ASA S/W to 9.1(7) as my current ASA s/w is 9.1(2)

Anyone can confirm??

Thanks a lot Guys....

Yours,
Kajeji

#3 xsimio

xsimio

    Advanced Member

  • Members
  • PipPipPip
  • 103 posts
  • 338 thanks
  • LocationBangalore

Posted 13 February 2016 - 11:32 AM

Give Cisco a call, they provide support for this issue even if you do not have a valid support contract with them.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Organization

Community

Downloads

Test Providers

Site Info


Go to top