Cisco Talospublished Dec 20, 18:09 UTC (Dec 20, 2019)ingested Sep 10, 06:19 UTC

Cisco ASA DoS bug attacked in wild

highVulnerability exploited in the wildimportance 60CVE-2018-0296

Read the original

Tagscve-2018-0296 vulnerability

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2018-0296	Unauthenticated DoS and Information Disclosure in Cisco ASA HTTP Web Services Cisco Adaptive Security Appliance (ASA) contains an improper input validation flaw (CWE-20) in how the device's HTTP web services process URLs. An unauthenticated, remote attacker can trigger it by sending crafted HTTP URLs to the ASA's web server, with no credentials required. Successful exploitation can crash and reload the appliance (denial of service) and can also disclose sensitive device memory contents (information disclosure). Any organization running an ASA, which is commonly deployed as an enterprise edge firewall and VPN gateway with a web management interface (ASDM), is potentially affected wherever that HTTP service is reachable by untrusted users. The flaw has been exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS assigns a 99.9% probability of exploitation within 30 days (percentile 100). Do: Apply updates per vendor instructions, upgrading ASA software to a fixed release identified in Cisco's security advisory. Until patched, restrict access to the appliance's HTTP/ASDM service (http server enable) to trusted management networks only, and disable it on any interface that does not require it. Audit internet-facing ASA devices for exposed web interfaces and review logs for anomalous crafted URL requests.	7.5	100%	KEV PoC ×2	Cisco Adaptive Security Appliance (ASA)	masshundreds of thousands of internet-exposed ASA devices (ASA is among the most common exposed firewalls in public internet scans)	Jun 7, 2018

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2018-0296

Unauthenticated DoS and Information Disclosure in Cisco ASA HTTP Web Services

Cisco Adaptive Security Appliance (ASA) contains an improper input validation flaw (CWE-20) in how the device's HTTP web services process URLs. An unauthenticated, remote attacker can trigger it by sending crafted HTTP URLs to the ASA's web server, with no credentials required. Successful exploitation can crash and reload the appliance (denial of service) and can also disclose sensitive device memory contents (information disclosure). Any organization running an ASA, which is commonly deployed as an enterprise edge firewall and VPN gateway with a web management interface (ASDM), is potentially affected wherever that HTTP service is reachable by untrusted users. The flaw has been exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS assigns a 99.9% probability of exploitation within 30 days (percentile 100).

Do: Apply updates per vendor instructions, upgrading ASA software to a fixed release identified in Cisco's security advisory. Until patched, restrict access to the appliance's HTTP/ASDM service (http server enable) to trusted management networks only, and disable it on any interface that does not require it. Audit internet-facing ASA devices for exposed web interfaces and review logs for anomalous crafted URL requests.

7.5

100%

KEV PoC ×2

Cisco Adaptive Security Appliance (ASA)

masshundreds of thousands of internet-exposed ASA devices (ASA is among the most common exposed firewalls in public internet scans)

Jun 7, 2018

Full article376 words · extracted from blog.talosintelligence.com · click to collapse

Friday, December 20, 2019 13:09

By Nick Biasini.

Cisco Talos has recently noticed a sudden spike in exploitation attempts against a specific vulnerability in our Cisco Adaptive Security Appliance (ASA) and Firepower Appliance. The vulnerability, CVE-2018-0296, is a denial-of-service and information disclosure directory traversal bug found in the web framework of the appliance. The attacker can use a specially crafted URL to cause the ASA appliance to reboot or disclose unauthenticated information.

This vulnerability was first noticed being exploited publicly back in June 2018, but it appeared to increase in frequency in the past several days and weeks. As such, we are advising all customers to ensure they are running a non-affected version of code. Additionally, we want to highlight that there is a Snort signature in place to detect this specific attack (46897). Concerned customers should ensure it is enabled in applicable policies that could detect this exploitation attempt.

Am I vulnerable?

Since this vulnerability lies in the web framework of the ASA/Firepower, not all appliances are affected. If an administrator wants to determine if they are vulnerable, there are a couple of commands that can be run to determine your risk. First, run the following command:

show asp table socket | include SSL|DTLS

If the command shows any listening sockets, then the potential for exploitation exists. The next step is to determine if the vulnerable process is running. That can be achieved by running the following command:

show processes | include Unicorn

If the process is shown as running, the likelihood of a vulnerability existing is elevated and the administrator should validate the running version of code on the appliance to determine if it is one of the affected versions listed in the advisory. If it is listed, then updating to a non-affected version is the most effective mitigation.

Conclusion

This isn't a new vulnerability, but as exploitation continues to increase, customers need to be aware of the risk of both a denial-of-service or unauthenticated information disclosure. Additionally, as we head into the holidays, people take time off, but adversaries do not. Customers should validate if they are vulnerable as soon as possible and plan the appropriate patching/mitigations strategies as necessary to minimize both risk and impact to the organization.

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/asa-bug-attacked-in-the-wild/