Denial of service when processing SIP packets in Cisco ASA and Cisco Firepower Threat Defense

Published: 2018-11-01 08:39:05 | Updated: 2018-11-01
Severity High
Patch available NO
Number of vulnerabilities 1
CVE ID CVE-2018-15454
CVSSv3 7.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:U/RC:C]
CWE ID CWE-20
Exploitation vector Network
Public exploit This vulnerability is being exploited in the wild.
Vulnerable software Firepower Threat Defense Software (FTD)
Cisco Firepower 9300 Security Appliance
Cisco Firepower 4100 Series Next-Generation Firewall
Firepower 2100 Series Security Appliance
Cisco Adaptive Security Virtual Appliance (ASAv)
Cisco 7600 Series ASA Services Module
Cisco ASA 5500-X Series
3000 Series Industrial Security Appliance (ISA)
Vulnerable software versions Firepower Threat Defense Software (FTD) -
Cisco Firepower 9300 Security Appliance 1.1(4.168)
Cisco Firepower 9300 Security Appliance 2.0(1.140)
Cisco Firepower 9300 Security Appliance 2.1(1.47)

Show more

Cisco Firepower 4100 Series Next-Generation Firewall 2.0(1.68)
Cisco Firepower 4100 Series Next-Generation Firewall 1.1(4.168)
Cisco Firepower 4100 Series Next-Generation Firewall 2.0(1.140)

Show more

Firepower 2100 Series Security Appliance -
Cisco Adaptive Security Virtual Appliance (ASAv) -
Cisco 7600 Series ASA Services Module -
Cisco ASA 5500-X Series 9.4(4)
Cisco ASA 5500-X Series 9.4(4.14)
Cisco ASA 5500-X Series 9.6(3.16)

Show more

3000 Series Industrial Security Appliance (ISA) -
Vendor URL Cisco Systems, Inc

Security Advisory

1) Input validation error

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of SIP traffic. A remote attacker can send specially crafted SIP packets to the affected device, cause high CPU load that may lead to denial of service conditions.

Note, this vulnerability is being actively exploited in the wild against a limited number of targets.

Remediation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181031-asaftd-sip-dos

Back to List