Denial of service when processing SIP packets in Cisco ASA and Cisco Firepower Threat Defense



Risk High
Patch available NO
Number of vulnerabilities 1
CVE-ID CVE-2018-15454
CWE-ID CWE-20
Exploitation vector Network
Public exploit This vulnerability is being exploited in the wild.
Vulnerable software

/

Cisco Firepower 9300 Security Appliance
Hardware solutions / Security hardware applicances

Cisco 7600 Series ASA Services Module
Hardware solutions / Security hardware applicances

Cisco ASA 5500-X Series
Hardware solutions / Security hardware applicances

Cisco Firepower 4100 Series Next-Generation Firewall
Hardware solutions / Firmware

Firepower 2100 Series Security Appliance
Server applications / IDS/IPS systems, Firewalls and proxy servers

3000 Series Industrial Security Appliance (ISA)
Server applications / IDS/IPS systems, Firewalls and proxy servers

Cisco Adaptive Security Virtual Appliance (ASAv)
Server applications / Virtualization software

Vendor
Cisco Systems, Inc

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Input validation error

EUVDB-ID: #VU15667

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:U/RC:C]

CVE-ID: CVE-2018-15454

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of SIP traffic. A remote attacker can send specially crafted SIP packets to the affected device, cause high CPU load that may lead to denial of service conditions.

Note, this vulnerability is being actively exploited in the wild against a limited number of targets.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

: All versions

Cisco Firepower 9300 Security Appliance: 1.1.3 - 2.2.1.101

Cisco Firepower 4100 Series Next-Generation Firewall: 1.1.3 - 2.2.1.101

Firepower 2100 Series Security Appliance: All versions

Cisco Adaptive Security Virtual Appliance (ASAv): All versions

Cisco 7600 Series ASA Services Module: All versions

Cisco ASA 5500-X Series: 9.1.6.11 - 9.9.2.230

3000 Series Industrial Security Appliance (ISA): All versions

CPE2.3 External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181031-asaftd-sip-dos


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.



###SIDEBAR###