2016 February 12 14:48 GMT
2016 February 10 16:00 GMT
Base - 10.0
No workarounds available
Cisco Bug IDs:
- A vulnerability in the Internet Key Exchange (IKE) version 1 (v1) and IKE version 2 (v2) code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code.
The vulnerability is due to a buffer overflow in the affected code area. An attacker could exploit this vulnerability by sending crafted UDP packets to the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system.
Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed firewall mode only and in single or multiple context mode. This vulnerability can be triggered by IPv4 and IPv6 traffic.
Cisco has released software updates that address this vulnerability. This advisory is available at the following link:
- Affected Cisco ASA Software running on the following products may be affected by this vulnerability:
- Cisco ASA 5500 Series Adaptive Security Appliances
- Cisco ASA 5500-X Series Next-Generation Firewalls
- Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
- Cisco ASA 1000V Cloud Firewall
- Cisco Adaptive Security Virtual Appliance (ASAv)
- Cisco Firepower 9300 ASA Security Module
- Cisco ISA 3000 Industrial Security Appliance
Cisco ASA Software is affected by this vulnerability if the system is configured to terminate IKEv1 or IKEv2 VPN connections.
This includes the following:
- LAN-to-LAN IPsec VPN
- Remote access VPN using the IPsec VPN client
- Layer 2 Tunneling Protocol (L2TP)-over-IPsec VPN connections
- IKEv2 AnyConnect
- Clientless SSL
- AnyConnect SSL
ciscoasa# show running-config crypto map | include interface
crypto map outside_map interface outside
Products Confirmed Not Vulnerable
No other Cisco products are currently known to be affected by this vulnerability.
- Cisco ASA 5500 Series Adaptive Security Appliances
- Cisco IPS Signature 7169-0 and Snort ID: 36903 can detect attempts to exploit this vulnerability.
- There are no workarounds that address this vulnerability.
- Cisco has released free software updates that address the vulnerability described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:
<a href="http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html" style="margin: 0px; padding: 0px; border: 0px; font-style: inherit; font-variant: inherit; font-weight: inherit; font-stretch: inherit; font-size: inherit; line-height: inherit; font-family: inherit; vertical-align: baseline; color: rgb(0, 127, 197); text-decoration: none; cursor: pointer; word-wrap: break-word;">http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html
Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.
When considering software upgrades, customers are advised to consult the Cisco Security Advisories and Responses archive athttp://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to upgrade contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Customers Without Service Contracts
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco Technical Assistance Center (TAC):
Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
In the following table, the left column lists major releases of Cisco ASA Software. The right column indicates whether a major release is affected by the vulnerability described in this advisory and the first release that includes the fix for this vulnerability.
Cisco ASA Major Release First Fixed Release 7.21 Affected; migrate to 9.1(7) or later 8.21 Affected; migrate to 9.1(7) or later 8.31 Affected; migrate to 9.1(7) or later 8.4 8.4(7.30) 8.51 Not affected 8.61 Affected; migrate to 9.1(7) or later 8.7 8.7(1.18) 9.0 9.0(4.38) 9.1 9.1(7) 9.2 9.2(4.5) 9.3 9.3(3.7) 9.4 9.4(2.4) 9.5 9.5(2.2)
- 1Cisco ASA Software releases 7.2, 8.2, 8.3, 8.5, and 8.6 have reached End of Software Maintenance. Customers should migrate to a supported release.
Cisco ASA Software can be downloaded from the Software Center on Cisco.com by visitinghttp://www.cisco.com/cisco/software/navigator.html.
For Cisco ASA 5500 Series Adaptive Security Appliances and Cisco ASA 5500-X Series Next-Generation Firewall, navigate to the following path. To find interim versions, click All Releases > Interim on the left side of the download page.
Products > Security > Firewalls > Adaptive Security Appliances (ASA) > ASA 5500-X Series Firewalls > <your Cisco ASA model> > Software on Chassis > Adaptive Security Appliance (ASA) SoftwareFor the Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, navigate to the following path. To find interim versions, click All Releases > Interim on the left side of the download page.
Products > Cisco Interfaces and Modules > Services Modules > Catalyst 6500 Series / 7600 Series ASA Services Module > Adaptive Security Appliance (ASA) SoftwareFor the Cisco ASA 1000V Cloud Firewall, navigate to the following path:
Products > Security > Firewalls > Adaptive Security Appliances (ASA) > ASA 1000V Cloud FirewallFor the Cisco Adaptive Security Virtual Appliance (ASAv), navigate to the following path:
Products > Security > Firewalls > Adaptive Security Appliances (ASA) > Adaptive Security Virtual Appliance (ASAv) > Adaptive Security Appliance (ASA) SoftwareFor the Cisco Firepower 9300 ASA Module, navigate to the following path:
Products > Security > Firewalls > Next-Generation Firewalls (NGFW) > Firepower 9000 Series > Firepower 9300 Security Appliance >Adaptive Security Appliance (ASA) SoftwareFor the Cisco ISA 3000 Industrial Security Appliance, navigate to the following path:
Products > Security > Firewalls > 3000 Series Industrial Security Appliances (ISA) > <your Cisco ISA 3000 model> > Adaptive Security Appliance (ASA) SoftwareShow Less
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any malicious use of the vulnerability that is described in this advisory.
Exodus Intelligence has provided a public blog post which is available at the following link:
This vulnerability was reported to Cisco by David Barksdale, Jordan Gruskovnjak, and Alex Wheeler of Exodus Intelligence.
Edited by vbsalongo, 12 February 2016 - 05:32 PM.