Vulnerability identifier: #VU13246

Vulnerability risk: Medium

CVSSv3.1: 8.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2018-0296

CWE-ID: CWE-23

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
3000 Series Industrial Security Appliance (ISA)
Server applications / IDS/IPS systems, Firewalls and proxy servers
Firepower 2100 Series Security Appliance
Server applications / IDS/IPS systems, Firewalls and proxy servers
Cisco ASA 1000V Cloud Firewall
Hardware solutions / Security hardware applicances
Cisco ASA 5500-X Series
Hardware solutions / Security hardware applicances
Cisco ASA 5500
Hardware solutions / Security hardware applicances
Cisco Firepower 9300 Security Appliance
Hardware solutions / Security hardware applicances
Cisco Adaptive Security Virtual Appliance (ASAv)
Server applications / Virtualization software
Cisco Firepower 4100 Series Next-Generation Firewall
Hardware solutions / Firmware

Vendor: Cisco Systems, Inc

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists in the web interface of the Cisco Adaptive Security Appliance (ASA) due to lack of proper input validation of the HTTP URL. A remote attacker can send a specially crafted HTTP request and cause the device to reload unexpectedly or read contest of arbitrary file on the system using directory traversal sequences.

Mitigation
Install update from vendor's website.

Vulnerable software versions

3000 Series Industrial Security Appliance (ISA): All versions

Cisco ASA 1000V Cloud Firewall : All versions

Cisco ASA 5500-X Series: All versions

Cisco ASA 5500: All versions

Cisco Adaptive Security Virtual Appliance (ASAv): All versions

Firepower 2100 Series Security Appliance: All versions

Cisco Firepower 4100 Series Next-Generation Firewall: All versions

Cisco Firepower 9300 Security Appliance: All versions

:

---

External links
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.