Cisco ASA and Firepower Being Exploited in the Wild - Apply Mitigations ASAP

Paul Davis

Cisco advised that the Adaptive Security Appliance (ASA) and Firepower systems are being exploited in the wild with a Session Initiation Protocol (SIP) vulnerability. Limited patches are available.

Background

Cisco posted an advisory on October 31 warning users that their popular Adaptive Security Appliance (ASA) and Firepower Threat Defense Software are vulnerable to a Session Initiation Protocol (SIP) handling bug currently being exploited in the wild. As of November 1 10:00 a.m. (EST), there was no patch or workaround available. Cisco has provided mitigation guidance.

Updated November 9: Cisco has started releasing updated versions and has a limited set of fixes available on their advisory page. 

Impact assessment

According to Cisco: “While the vulnerability described in this advisory is being actively exploited, the output of show conn port 5060 will show a large number of incomplete SIP connections and the output of show processes cpu-usage non-zero sorted will show a high CPU utilization. Successful exploitation of this vulnerability can also result in a denial of service (DOS) causing the affected device to crash and reload. After the device boots up again, the output of show crashinfo will show an unknown abort of the DATAPATH thread.”

Vulnerability details

The vulnerability is reportedly caused by improper SIP inspection. SIP is a common protocol used for voice over IP (VoIP). It is also used for file transfer, instant messaging, video conferencing and streaming media. SIP can be run over TCP, UDP or other networking protocols. The following Cisco devices are listed as affected:

  • 3000 Series Industrial Security Appliance (ISA)
  • ASA 5500-X Series Next-Generation Firewalls
  • ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
  • Adaptive Security Virtual Appliance (ASAv)
  • Firepower 2100 Series Security Appliance
  • Firepower 4100 Series Security Appliance
  • Firepower 9300 ASA Security Module
  • FTD Virtual (FTDv)

The vulnerability reportedly does not impact the following devices:

  • ASA 1000V Cloud Firewall
  • ASA 5500 Series Adaptive Security Appliances

Urgently required actions

Due to the fact this issue is reportedly being exploited in the wild and the “default on” nature of SIP inspection, users are urged to update immediately or apply the mitigations provided by Cisco ASAP. Several mitigating controls are provided:

  • Disabling SIP inspection (on by default): Disabling SIP inspection will completely close the attack vector for this vulnerability. However, it may not be suitable for everyone. In particular, disabling SIP inspection would break SIP connections if either Network Address Translation (NAT) is applied to SIP traffic or if not all ports required for SIP communication are opened via ACL. To disable SIP inspection, configure the following:

Cisco ASA Software and Cisco FTD Software Releases 6.2 and later (in FTD 6.2 and later use Cisco FMC to add the following via FlexConfig policy):

policy-map global_policy
class inspection_default
no inspect sip

Cisco FTD Software Releases prior to 6.2:

configure inspection sip disable

Additionally, the mitigations below are described in the advisory:

  • Blocking the attacking host
  • Filtering on Sent-by Address of 0.0.0.0, as that address has reportedly been used by attackers in ongoing exploitation
  • Rate limiting SIP traffic

Identifying affected systems

A list of Nessus plugins to identify this vulnerability can be found here.

Get more information

Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

Read more >

Published on Nov 1, 2018

People also viewed

Technical Support Engineer

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Technical Support Technical Support
Your Role:Tenable is looking for motivated individuals to join our Technical Support Team. The Technical Support Engineer (TSE) is the first contact for all customers when they require technical assistance.  In a time when the next Spectre and Mel...

Customer Success Manager - APAC Nessus

Singapore Singapore Singapore North Bridge Road, Parkview Square, Singapore, 188788 Customer Success Sales
Your Role:Tenable has an immediate need for a Customer Success Manager who will be responsible for establishing and driving sales activities for our software products within a designated geography. You will be expected to penetrate and prospect na...

Sales Development Representative

Singapore Singapore Singapore North Bridge Road, Parkview Square, Singapore, 188788 Lead Generation Sales
Your Role:The Sales Development Representative supports remote sales teams in and is responsible for generating new business via inbound and outbound phone opportunity qualification. Your Opportunity: Perform outbound calling to generate new sales...

Security Engineer - Mexico

Mexico City Mexico Mexico Presidenta Masarik, Polanco V Seccion, Mexico City, Mexico, 21045 Sales Engineering Sales
Your Role:Tenable is seeking a Security Engineer to support demos and evaluations of enterprise opportunities across the territory. Assist in developing business value propositions around Tenable's products and solutions. Drives sales with technic...

Director of Engineering - Shared Services Infrastructure

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Sensors Engineering
Your Role:Tenable is looking for a talented and energetic Director of Software Engineering to lead the Shared Services Infrastructure (SSI) development team. The SSI team helps organizations address key challenges of traditional vulnerability scan...

Principal UX Designer

San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Cloud Platforms Engineering
Your Role:Tenable is looking for an extraordinary Principal UX Designer to join our team. Our group is chartered with creating the next generation of security products while at the same time pioneering unprecedented user experience in the digital ...

We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.