Denial of service when processing SIP packets in Cisco ASA and Cisco Firepower Threat Defense

1) Input validation error

EUVDB-ID: #VU15667

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:U/RC:C]

CVE-ID: CVE-2018-15454

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of SIP traffic. A remote attacker can send specially crafted SIP packets to the affected device, cause high CPU load that may lead to denial of service conditions.

Note, this vulnerability is being actively exploited in the wild against a limited number of targets.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

: All versions

Cisco Firepower 9300 Security Appliance: 1.1.3 - 2.2.1.101

Cisco Firepower 4100 Series Next-Generation Firewall: 1.1.3 - 2.2.1.101

Firepower 2100 Series Security Appliance: All versions

Cisco Adaptive Security Virtual Appliance (ASAv): All versions

Cisco 7600 Series ASA Services Module: All versions

Cisco ASA 5500-X Series: 9.1.6.11 - 9.9.2.230

3000 Series Industrial Security Appliance (ISA): All versions

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181031-asaftd-sip-dos

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.