Cisco Products Affected By A Zero-Day SIP Inspection Vulnerability Exploited In The Wild

  • 210
  •  
  •  
  •  
  •  
  •  
  •  
  •  
    210
    Shares

Cisco has revealed about a serious vulnerability that the hackers have already exploited in the wild. As per their disclosure, the Cisco ASA and FTD security software have suffered a SIP inspection vulnerability that allows the attackers to crash the devices running these software. For now, no patches or workarounds are available for the bug, however, Cisco recommends some methods as possible mitigations.

SIP Inspection Vulnerability Targets Cisco Security Tools

Reportedly, Cisco has found a serious security flaw affecting its Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) security software. The vulnerability exists in the Session Initiation Protocol (SIP) inspection engine of these programs. As disclosed by Cisco, the vulnerability has already been exploited by hackers to target Cisco devices.

Describing the flaw in their advisory, Cisco stated,

A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload or trigger high CPU, resulting in a denial of service (DoS) condition.

The vulnerability exists due to improper SIP traffic handling. To trigger this bug, an attacker can send specially crafted SIP requests “at a high rate across an affected device”.

The Cisco team discovered this vulnerability while addressing a TAC support case. Hence they became aware of the exploitation of this bug by malefactors.

The vulnerability “Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Denial of Service Vulnerability” (CVE-2018-15454) has received a CVSS base score of 8.6 with a high severity rating.

The CVE-2018-15454 vulnerability affects the devices running vulnerable ASA and FTD versions. These include Cisco ASA Software Release 9.4 and later releases, and Cisco FTD Software Release 6.0 and later. The bug becomes active when SIP inspection is enabled. This is true for both physical and virtual appliances. Affected Cisco products include:

  • 3000 Series Industrial Security Appliance (ISA)
  • ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
  • Adaptive Security Virtual Appliance (ASAv)
  • ASA 5500-X Series Next-Generation Firewalls
  • Firepower 9300 ASA Security Module
  • FTD Virtual (FTDv)
  • Firepower 2100 Series Security Appliance
  • Firepower 4100 Series Security Appliance

Possible Mitigations

Presently, no patched update of the affected software or workaround is available for the bug. However, Cisco has suggested some ways to mitigate this vulnerability. This includes disabling the SIP inspection. However, it may break the SIP connections under certain conditions. Besides, users can block the traffic from an attacker’s IP address using the ACL (access control list) or by running the shun <ip_address> command in the EXEC mode.

Another possible mitigation for the flaw includes filtering the IP address 0.0.0.0 for the “sent-by address”, which Cisco has found to exist in case of most exploits. Moreover, users can also simply rate limit the SIP traffic via the Modular Policy Framework (MPF).

Let us know your thoughts in the comments section.

The following two tabs change content below.

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Leave a Reply

Do NOT follow this link or you will be banned from the site!