Cisco fixes high-risk DoS flaw in ASA, FTD Software

Cisco addressed a high severity DoS vulnerability in the Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software.

Cisco this week released security updates for a high severity vulnerability in the Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) products.

The flaw resides in the software cryptography module of both ASA and FTD software, an attacker in a man-in-the-middle position could exploit the issue to trigger a DoS condition and cause an unexpected reload of a vulnerable device.

“A vulnerability in the software cryptography module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the device that results in a denial of service (DoS) condition.” reads the advisory published by Cisco.

“The vulnerability is due to a logic error in how the software cryptography module handles specific types of decryption errors. An attacker could exploit this vulnerability by sending malicious packets over an established IPsec connection. A successful exploit could cause the device to crash, forcing it to reload. Important: Successful exploitation of this vulnerability would not cause a compromise of any encrypted data.”

The issue is related to a logic error in the way the module handles decryption errors. An attacker could trigger the flaw by sending malicious packets over an established IPsec connection causing a device crash, forcing it to reload.

The company pointed out that exploitation of the flaw would not cause a compromise of any encrypted data.

The vulnerability affects products running ASA Software Release 9.16.1 and Cisco FTD Software Release 7.0.0 and that supports IPsec connections to the device:

No workarounds are available to mitigate this flaw, but the IT giant already released security patches to fix the flaw. The good news is that Cisco was not aware of attacks in the wild exploiting the vulnerability.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco ASA)