Multiple vulnerabilities in Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software

Published: 2021-10-29

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2021-34790 CVE-2021-34791
CWE-ID	CWE-358
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Cisco Adaptive Security Appliance (ASA) Hardware solutions / Security hardware applicances Cisco Firepower Threat Defense (FTD) Hardware solutions / Security hardware applicances
Vendor	Cisco Systems, Inc

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improperly implemented security check for standard

EUVDB-ID: #VU57796

Risk: Medium

CVSSv3.1: 4.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34790

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient traffic validation within the Session Initiation Protocol (SIP) Application Level Gateway (ALG) for the Network Address Translation (NAT) feature. A remote attacker can send a specially crafted SIP traffic, open unauthorized connections to the remote host and undertake actions leveraging that host.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco Adaptive Security Appliance (ASA): 9.8 - 9.15

Cisco Firepower Threat Defense (FTD): 6.2.2 - 6.7.0

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improperly implemented security check for standard

EUVDB-ID: #VU57797