Cisco Warns of Zero-Day Vulnerability in Security Appliances
2.11.2018 securityweek Vulnerebility

Cisco informed customers on Wednesday that some of its security appliances are affected by a serious vulnerability that has been actively exploited.

The zero-day flaw, tracked as CVE-2018-15454, is related to the Session Initiation Protocol (SIP) inspection engine used in the company’s Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software.

A remote and unauthenticated attacker can exploit the vulnerability to cause an affected device to reload or consume CPU resources, resulting in a denial-of-service (DoS) condition. The bug, related to how SIP traffic is handled, can be triggered by sending specially crafted SIP requests to the targeted device at a high rate.

Cisco said it became aware of the vulnerability during the resolution of a technical assistance center (TAC) support case.

The flaw impacts ASA software version 9.4 and later and FTD software version 6.0 and later if SIP inspection is enabled – the feature is enabled by default. The list of affected products includes 3000 Series Industrial Security Appliance (ISA); ASA Virtual; ASA 5500-X firewall; ASA service modules for Catalyst 6500 and 7600 switches and routers; Firepower 2100, 4100 and 9300; and FTD Virtual.

No patches or workarounds are available at this time, but attacks can be mitigated by blocking hosts that launch attacks, disabling SIP inspection, and filtering out traffic with a “Sent-by Address” set to 0.0.0.0, which Cisco says has been used in many of the attacks it spotted.

As for indicators of compromise (IoC), Cisco noted that the show conn port 5060 command will show a large number of incomplete SIP connections if the vulnerability is being exploited. Furthermore, the show process cpu-usage non-zero sorted command will indicate high CPU usage.

“Successful exploitation of this vulnerability can also result in the affected device crashing and reloading. After the device boots up again, the output of show crashinfo will show an unknown abort of the DATAPATH thread. Customer should reach out to Cisco TAC with this information to determine whether the particular crash was related to exploitation of this vulnerability,” Cisco said.

Zero-day vulnerabilities in Cisco products are not very common. In the past two years, the company addressed two such flaws: one leaked by Shadow Brokers from the NSA-linked Equation Group, and one made public by WikiLeaks after it had been stolen from the CIA.

There were also at least two campaigns this year that exploited Cisco ASA vulnerabilities shortly after they were patched.