Cisco ASA Remote Code Execution Vulnerability

On January 29^th Cisco publicly disclosed a vulnerability in the Cisco Adaptive Security Appliance (ASA) that has been labeled as CVE-2018-0101 [1]. The ASA vulnerability may allow for Remote Code Execution and Denial of Service (DoS). Initial reports state that there are approximately 200,000 active vulnerable devices exposed to the internet. There is no workaround option for this vulnerability so patching is required to remain secure.

On Friday, February 2^nd the researchers who discovered the vulnerability are hosting a public talk to review their discovery and the technical details involved [2]. The public disclosure of technical details may increase the risk of weaponization.

What we’re doing about it

• The lack of information surrounding CVE-2018-0101 has made detection difficult at this time.
• eSentire is currently evaluating network detection signatures.
• The eSentire Threat Intelligence team is actively monitoring the situation.

What you should do about it

• After performing a business impact review, apply the security software update provided by Cisco.

Additional information

The vulnerability occurs due to an attempt to double free memory on Cisco ASA devices when the webpvn feature is active. Attackers can send a specially crafted XML packet to an affected device and execute malicious code. For additional technical details see the Cisco Vulnerability release [3].

Affected Devices:

• 3000 Series Industrial Security Appliance (ISA)
• ASA 5500 Series Adaptive Security Appliances
• ASA 5500-X Series Next-Generation Firewalls
• ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
• ASA 1000V Cloud Firewall
• Adaptive Security Virtual Appliance (ASAv)
• Firepower 2100 Series Security Appliance
• Firepower 4110 Security Appliance
• Firepower 9300 ASA Security Module
• Firepower Threat Defense Software (FTD)

[1] https://nvd.nist.gov/vuln/detail/CVE-2018-0101

[2] https://twitter.com/NCCGroupInfosec/status/958045910625325056

[3] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1