vSOC SPOT Report: Vulnerability in CISCO ASA SIP (CVE-2018-15454)

Overview

This SPOT Report contains information on the latest vulnerability found in the Cisco ASA firewall, Cisco switches, and Cisco routers alongside the coupling ASA virtual appliances and Cisco Firepower Threat Defense [FTD] security modules. The vulnerability is being actively exploited and targeted and opportunistic exploitation is likely to rise rapidly.

Technical Overview

Recently, Cisco Systems disclosed a vulnerability in its code that will allow an unauthenticated remote user to conduct a Denial of Service [DoS] attack in the *Session Initiation Protocol [SIP] inspection engine and Firepower Threat Defense [FTD] software running on the following Cisco IOS versions:

• Cisco ASA version 9.4 and newer
• Cisco FTD version 6.0 and newer

*The Session Initiation Protocol [SIP] is enabled by default on all of the Cisco products.

Potential Impact

The exploitation can cause an affected device to render high CPU conditions that will impede traffic and engage in a Denial of Service [DoS] attack.

The Session Initiation Protocol [SIP] allows for an unauthenticated remote user to send malicious SIP requests to misconfigured SIP traffic.   

This vulnerability will affect the following appliances:

• 3000 Series Industrial Security Appliance (ISA)
• ASA 5500-X Series Next-Generation Firewalls
• ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
• Adaptive Security Virtual Appliance (ASAv)
• Firepower 2100 Series Security Appliance
• Firepower 4100 Series Security Appliance
• Firepower 9300 ASA Security Module
• FTD Virtual (FTDv)

What You Should Do

NOTE: Currently, Cisco has not released any updates for this vulnerability and there is no known fix for this issue.

Any traffic that is traversing an affected device should be blocked. It is also recommended to disable the SIP inspection engine feature on ‘sent-by address of 0.0.0.0’ for all vulnerable products running the Cisco ASA 9.4 and FTD 6.0 IOS version software. Additional mitigation options can be found on the second page linked below.

Supporting Information

• https://news.softpedia.com/news/high-impact-dos-vulnerability-found-in-cisco-asa-and-ftd-actively-exploited-523546.shtml
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181031-asaftd-sip-dos