Denial of service in Adaptive Security Appliance (ASA) CX - CVE-2016-9225

Detailed vulnerability description

The vulnerability allows a remote attacker to cause denial of service (DoS).

The vulnerability exists within the data plane IP fragment handler of the Adaptive Security Appliance (ASA) CX Context-Aware Security module when processing IP fragments. A remote attacker can send specially crafted fragmented IP traffic across the vulnerable device, exhaust free packet buffers in shared memory (SHM) and trigger denial of service (DoS) conditions.

Successful exploitation of the vulnerability may allow an attacker perform DoS attack against vulnerable device.

How to mitigate CVE-2016-9225

Cisco Adaptive Security Appliance CX Context-Aware Security modules has entered its end-of-life (EoL) process and vendor is not planning to issue security fix to address this vulnerability.

Cisco recommends the following workaround:

Configure ASA to drop any IP fragments it receives as follows:

ASA# conf t
ASA(config)# fragment chain 1
ASA(config)# exit

Sources

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-cas