Multiple vulnerabilities in Cisco ASA and Cisco FTD



Published: 2022-04-27
Risk Medium
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2022-20759
CVE-2022-20742
CVE-2022-20760
CVE-2022-20745
CWE-ID CWE-266
CWE-325
CWE-400
CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Cisco Adaptive Security Appliance (ASA)
Hardware solutions / Security hardware applicances

Cisco Firepower Threat Defense (FTD)
Hardware solutions / Security hardware applicances

Vendor Cisco Systems, Inc

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Incorrect Privilege Assignment

EUVDB-ID: #VU62670

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-20759

CWE-ID: CWE-266 - Incorrect Privilege Assignment

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to improper separation of authentication and authorization scopes in the web services interface for remote access VPN feature. A remote authenticated user can send specially crafted HTTP requests to gain privilege level 15 access to the web management interface of the device

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco Adaptive Security Appliance (ASA): before 9.8.4.43, 9.16.2.13, 9.17.1.7, 9.15.1.21, 9.14.4, 9.12.4.38

Cisco Firepower Threat Defense (FTD): before 7.0.2, 6.4.0.15, 6.7.0.4, 6.6.5.2, 7.1.0.1


CPE2.3 External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-mgmt-privesc-BMFMUvye
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz92016

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Missing Required Cryptographic Step

EUVDB-ID: #VU62669

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-20742

CWE-ID: CWE-325 - Missing Required Cryptographic Step

Exploit availability: No

Description

The vulnerability allows a remote attacker to read or modify data within an IPsec IKEv2 VPN tunnel.

The vulnerability exists due to improper implementation of Galois/Counter Mode (GCM) ciphers in an IPsec VPN library. A remote attacker can perform MitM attack by intercepting a sufficient number of encrypted messages across an affected IPsec IKEv2 VPN tunnel and then using cryptanalytic techniques to break the encryption.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco Adaptive Security Appliance (ASA): before 9.12.4.37, 9.14.3.13, 9.16.2.7, 9.15.1.21

Cisco Firepower Threat Defense (FTD): before 7.0.2, 6.7.0.4, 6.6.5.1, 6.4.0.13


CPE2.3 External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ipsec-mitm-CKnLr4
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz81480

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource exhaustion

EUVDB-ID: #VU62668

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-20760

CWE-ID: CWE-400 - Uncontrolled Resource Consumption ('Resource Exhaustion')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources in the DNS inspection handler. A remote attacker can send specially crafted DNS requests to the affected device, trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco Adaptive Security Appliance (ASA): before 9.17.1.7, 9.16.2.14, 9.15.1.21, 9.14.4, 9.12.4.38

Cisco Firepower Threat Defense (FTD): before 7.0.2, 6.4.0.15, 6.7.0.4, 6.6.5.2, 7.1.0.1


CPE2.3 External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-dos-nJVAwOeq
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz76966

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU62667

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-20745

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web services interface for remote access VPN feature. A remote attacker can send specially crafted HTTP requests to the device and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco Adaptive Security Appliance (ASA): 9.12 - 9.16.2.3

Cisco Firepower Threat Defense (FTD): 6.2.2 - 6.2.2.1, 6.2.3 - 6.2.3.17, 6.3.0 - 6.3.0.6, 6.4.0 - 6.4.0.12, 6.5.0 - 6.5.0.5, 6.6.0 - 6.6.5, 6.7.0 - 6.7.0.3, 7.0.0 - 7.0.1


CPE2.3 External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asafdt-webvpn-dos-tzPSYern
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz70595

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###